Am I Being Pwned?
Get started

Is Song Identifier safe?

Medium risk

Song Identifier captures a 5-second audio fingerprint from active tab media and sends it to ACRCloud, using hardcoded API credentials.

When a user clicks the extension's browser action button, it injects a script into the active tab that captures audio from any playing media element for 5 seconds using the browser's media stream API. The captured audio is base64-encoded and POSTed to identify-eu-west-1.acrcloud.com to identify the song. The extension bundles hardcoded ACRCloud API credentials (host, key, and secret) in plaintext in secret.js, meaning those credentials are visible to anyone who inspects the extension.

losnappasv3.5Firefox Add-ons
45Risk
Who publishes it

losnappas - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
losnappas
Website
gitlab.com/losnappas/Song-identifier

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

acrcloud.com
Also called by 3 other listings, including AHA Music

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Bundled ACRCloud keys sign recognition requests

MediumunwantedCWE-522Dynamic sandbox

The extension bundle contains fallback ACRCloud API credentials.

What actually happens

You did this

You start song recognition from the extension.

The extension did this

The extension signs the recognition upload with bundled ACRCloud fallback credentials when no saved credentials are set.

Credential and request fields present in the shipped extension

  • Recognition host
    identify-eu-west-1.acrcloud.com

    Shows where the extension sends the audio recognition request after you start identification.

  • Bundled access key
    access_key=<redacted>

    This value identifies the bundled ACRCloud account used when you have not saved your own credentials.

  • Bundled signing credential
    signing_credential=<redacted>

    This value is used to calculate the request signature for the recognition upload.

  • Audio sample field
    sample=UklGRiQAAABXQVZFZm10IBAAAAABAAEAQB8AAIA+AAACABAAZGF0YQAAAAA=

    The recognition request includes a base64-encoded sample from the audio you asked the extension to identify.

  • Request signature
    signature=Jm8x1rj4wVZlGqfGgsXj3sBeP9Y=

    The extension adds a signature calculated from the endpoint, access key, data type, version, and timestamp.

Captured request

POSThttps://identify-eu-west-1.acrcloud.com/v1/identify

The code that does this

Bundled credentials, signing, and fallback selection

Readable version

Bundled ACRCloud fallback credentials

deobfuscated bundled credential module
var secret = {    host: "identify-eu-west-1.acrcloud.com",    key: "<redacted>",    secret: "<redacted>"}export default secret

HMAC signing and identify request construction

deobfuscated/dist/index.js
function create_sign(data, secret_key) {  return _crypto.default.createHmac('sha1', secret_key).update(data).digest().toString('base64');}function recognize(host, access_key, secret_key, query_data, query_type) {  return new Promise(function (resolve, reject) {    var http_method = "POST";    var http_uri = "/v1/identify";    var data_type = query_type;    var signature_version = "1";    var current_date = new Date();    var minutes = current_date.getTimezoneOffset();    var timestamp = parseInt(current_date.getTime() / 1000) + minutes * 60 + '';    var sample_bytes = query_data.length + '';    var string_to_sign = http_method + "\n" + http_uri + "\n" + access_key + "\n" + data_type + "\n" + signature_version + "\n" + timestamp;    var sign = create_sign(string_to_sign, secret_key);    var post_data = {      'access_key': access_key,      'sample_bytes': sample_bytes,      'sample': query_data.toString('base64'),      'timestamp': timestamp,      'signature': sign,      'data_type': data_type,      'signature_version': signature_version    };    var content = _querystring.default.stringify(post_data);    var req = _axios.default.post("https://" + host + http_uri, content).then(function (res) {      console.log('statusCode:', res.status);      console.log('headers:', res.headers);      resolve(res.data);    }).catch(function (err) {      console.log('SONG IDENTIFIER: problem with request: ' + err);      reject(err);    });  });}var host = _secret.default.host;var your_access_key = _secret.default.key;var your_access_secret = _secret.default.secret;var data_type = 'audio';

Options page can save replacement credentials

deobfuscated/options/options.js
function save(e) {	// uhh whatever	let v = len.value	v = v > 15 ? 15 : v	// local vs sync probs no big deal in performance - hoping it is cached somewhere.	browser.storage.sync.set({		len: v,		host: host.value,		key: key.value,		secret: secret.value	})}function restore() {	browser.storage.sync.get()	.then(values => {		len.value = values.len || ''		host.value = values.host || ''		key.value = values.key || ''		secret.value = values.secret || ''	})}len.addEventListener('change', save)host.addEventListener('change', save)key.addEventListener('change', save)secret.addEventListener('change', save)document.addEventListener('DOMContentLoaded', restore)

External service contacted for recognition

    • identify-eu-west-1.acrcloud.com

    ACRCloud identify API receives the signed recognition request and audio sample when song recognition runs.

What it can do

Permissions this extension asks for, as declared in version 3.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on acrcloud.com

    *://*.acrcloud.com/v1/identify

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Song Identifier contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • identify-eu-west-1.acrcloud.com

    Song Identifier sends data to identify-eu-west-1.acrcloud.com. No other extension we have analyzed sends data here.

Updated 2 November 2026amo-914435