Is Remove YouTube Shorts safe?
Remove YouTube Shorts is medium risk. On install/update, the service worker collects your user-agent, platform, IP, and country, hashes them, and sends the fingerprint to arktech-plugins.vercel.app, unrelated to its purpose, after a random 1-21s delay, then caches it locally.
Who publishes itArkTech - no other listings under this identity
ArkTech - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Fingerprinting Beacon Transmitted on Install
On install/update, the service worker collects your user-agent, platform, IP, and country, hashes them, and sends the fingerprint to arktech-plugins.vercel.app, unrelated to its purpose, after a random 1-21s delay, then caches it locally.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install or update Remove YouTube Shorts.
The extension collects your IP address, user-agent, platform, and country, hashes them into a fingerprint, and sends it to arktech-plugins.vercel.app.
The transmission happens automatically after a randomized 1-21 second delay. No prompt or UI element is shown.
Dynamic analysis captured 3 POST requests to this endpoint during dynamic analysis with reason=update replay. Body format: hash prefix (up to 30 chars) + colon-separated platform, IP, and country.
- Content-Type
- application/json
{ "UID": "-o648n0:Linux x86_64:82.3.220.102:GB"}- User-agent stringMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Your browser version and operating system, e.g. 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36'.
- PlatformLinux x86_64
Your operating system platform reported by the browser, e.g. 'Linux x86_64'.
- Public IP address82.3.220.102
Your network's public IP address, fetched from api.country.is at install time.
- Country codeGB
Your country derived from your IP address at install time.
The fingerprinting and transmission logic in background.js:
Readable equivalent with comments
chrome.runtime.onInstalled.addListener(async (event) => { // Fires on both fresh install and extension update if (event.reason !== 'install' && event.reason !== 'update') return; chrome.storage.local.get('shortsRemoverUniqueUserId', async (stored) => { // Only runs if no UID has been persisted yet (i.e. first time) if (stored.shortsRemoverUniqueUserId) return; // Step 1: Collect device data const userAgent = navigator.userAgent; const platform = navigator.platform; let ip = 'unknown_ip'; let country = 'unknown_country'; try { // Fetch public IP + country from a third-party geolocation service const resp = await fetch('https://api.country.is/'); const data = await resp.json(); ip = data.ip || 'unknown_ip'; country = data.country || 'unknown_country'; } catch (_) {} // Step 2: Build fingerprint hash (djb2 variant, base-36, sliced to 30 chars) function djb2Hash(str) { let h = 0; for (let i = 0; i < str.length; i++) { h = (h << 5) - h + str.charCodeAt(i); h |= 0; // convert to 32-bit int } return h.toString(36); } const raw = `${userAgent}:${platform}:${ip}:${Date.now()}:${country}`; const uid = `${djb2Hash(raw).slice(0, 30)}:${platform}:${ip}:${country}`; // Example result: '-o648n0:Linux x86_64:82.3.220.102:GB' // Step 3: Wait a random 1–21 seconds, then POST the UID const delaySecs = Math.floor(21 * Math.random()) + 1; await new Promise(resolve => setTimeout(resolve, delaySecs * 1000)); const body = { UID: uid }; const res = await fetch('https://arktech-plugins.vercel.app/api/reciveInfo', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }); if (res.ok) { // Persist so future installs/updates don't re-transmit chrome.storage.local.set({ shortsRemoverUniqueUserId: uid }); } });});- api.country.is
Geolocation lookup service; extension fetches the user's public IP and country code from this endpoint during fingerprint construction.
- arktech-plugins.vercel.app
Developer-controlled endpoint on Vercel's hosting platform. Receives the derived fingerprint UID via POST on first install or update.
What it can do
Permissions this extension asks for, as declared in version 2.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 2.1.7, which we have not unpacked yet.
Read and change your data on youtube.com
*://*.youtube.com/*
Store data in your browser
storage