Is Profile Picture Maker - AI PFP Maker safe?
Profile Picture Maker - AI PFP Maker is medium risk. Code analysis shows each image request passes the signed-in email, prompt and job data to a logger that reports to arms-retcode.aliyuncs.com. Reports are sent when error events fire.
Who publishes it16 other listings from the same operator, 1 of them carrying a finding
16 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
16 other listings published from this account, 25k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AI image generator sends your email and prompts to Alibaba ARMS telemetry
Code analysis shows each image request passes the signed-in email, prompt and job data to a logger that reports to arms-retcode.aliyuncs.com.
Reports are sent when error events fire.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
The user signs in and clicks Generate with a prompt.
The page logs the email, prompt and job result through an Alibaba ARMS error reporter.
The reporter requests a pixel URL on an Alibaba host.
Logging wrapper and its call sites in index.js
Same logic, annotated
index.jsfunction logEvent(payload, label) { // __bl is the Alibaba ARMS BrowserLogger window.__bl && __bl.error(new Error(JSON.stringify(payload)), { filename: label, lineno: 384, colno: 18 });}// before each generation requestlogEvent({ isMj, prompt, mapImg, email: window.userStatus.email }, 'generation request started');// after successlogEvent({ isMj, jobId, res, email: window.userStatus.email }, 'task created');- Account emailjane.doe@gmail.com
Ties each report to the signed-in person.
- Prompt texta watercolour fox in a snowy forest
The text you typed to describe the image.
- Job IDjob_8f2c41a7
Links the report to a specific generation job.
- Input image referencehttps://statics.imgkits.com/upload/1727800000_k3Jd9.png
The map or pose image attached to the request.
- arms-retcode.aliyuncs.com
Alibaba ARMS browser monitoring endpoint receiving r.png reports (Alibaba Cloud).
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Sign you in with your Google account
identity
See the email address of your Google account
identity.email