Is Suno AI Music Generator safe?

High risk

Suno AI Music Generator sends its login passport token to Alibaba ARMS telemetry during sign-in.

During sign-in, the extension posts the Chrome profile identifier to www.livepolls.app and stores the returned passport token as login_passport. It then logs that passport value through Alibaba ARMS error telemetry, while the same value is also used as the X-Access-Ticket credential for account and download API calls.

v2.7Chrome Web Store
72Risk
Who publishes it

5 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

5 other listings published from this account, 13k+ users between them. 1 of them carries a finding.

Udio AI Music Generator5k+MediumMicrosoft Word Translator - Translate Word online4k+MediumYouTube Video Dubbing2k+CleanEPUB Translator - Translate Ebook Online1k+CleanAI Avatar Generator686Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Login token sent to Alibaba ARMS telemetry

Signing in to Suno AI Music Generator makes it request a login passport token from livepolls.app and store it for later use.

That token is also passed into Alibaba's ARMS telemetry client, which beacons to arms-retcode.aliyuncs.com/r.png.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You sign in from the extension interface.

The handler requires a Chrome profile identifier before it requests the extension passport.

The extension did this

The extension stores the returned passport token and also places it in an ARMS telemetry event.

This happens immediately after the token is received.

Credential-like fields handled by the sign-in flow
  • Login passport token
    passport=8f4e61a9c2b74653a0d4b9e717cc2a31 (illustrative)

    This token represents your signed-in extension session and is reused for authenticated extension requests.

  • Chrome profile identifier
    google_uid=109384756201938475620 (illustrative)

    This connects the passport request to the browser profile used during sign-in.

  • Telemetry event label
    addson_to_login

    This labels the telemetry record as part of the extension login flow.

Captured request
POSThttps://arms-retcode.aliyuncs.com/r.png?
The code that does this

The shipped bundle passes the passport into ARMS telemetry

Readable version

Passport request and access-ticket reuse

index.js
const API_ROOT = "https://www.livepolls.app/suno_ai_music_generator";function requestPassport(googleUid) {  return http({    url: API_ROOT + "/api/user/passport",    data: { google_uid: googleUid },    method: "POST",    headers: { "Content-Type": "application/json" }  });}function requestUserStatus(passport, uuid) {  const headers = {    "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",    "X-Access-Ticket": passport  };  const data = { app_type: window.app_type ? window.app_type : undefined };  if (uuid) data.uuid = uuid;  return http({    url: API_ROOT + "/api/user/status",    data,    method: "POST",    headers  });}function downloadOrder(count = 1) {  const passport = localStorage.getItem("login_passport");  return http(passport ? {    url: "https://www.livepolls.app/suno_ai_music_generator/api/order/download",    headers: { "X-Access-Ticket": passport }  } : {    url: API_ROOT + "/api/order/download",    data: { cnt: count },    method: "POST",    headers: { "Content-Type": "application/json" }  });}

Telemetry wrapper

index.js
function logToArms(payload, filename) {  if (window.__bl) {    __bl.error(new Error(JSON.stringify(payload)), {      filename,      lineno: 384,      colno: 18    });  }}

Login handler

index.js
async function handleLogin(subscribe = false) {  let passportResponse;  if (appConfig.type === "web") {    loginWindow = window.open(`${loginHost}/login?close=1&${window.app_type ? "from=" + window.app_type + "&" : ""}${subscribe === true ? "subscribe=1" : ""}`);    watchLoginWindow(subscribe === true ? "loginAndSubscribed" : "login");    return;  }  if (!google_uid) {    logToArms({ type: "login button" }, "login_no_google_uid");    needsBrowserLogin.value = true;    toast.error("Please log in to your browser account first before using");    return;  }  const loading = loadingService({ text: "loading...", background: "rgba(0, 0, 0, 0.7)" });  try {    const response = await requestPassport(google_uid);    passport = response?.data?.passport;    localStorage.setItem("login_passport", passport);    logToArms({ passport }, "addson_to_login");    loading.close();    try { document.body.classList.remove("el-loading-parent--relative"); } catch {}    loginWindow = window.open(loginHost + "/login?passport=" + encodeURIComponent(passport) + (subscribe ? "&subscribe=1" : "") + (google_uid ? "&user_id=" + google_uid : "") + (window.app_type ? "&from=" + window.app_type : ""));    watchLoginWindow(subscribe ? "loginAndSubscribed" : "login");  } catch (error) {    logToArms({ error }, "addson_get_passport_error");    loading.close();    try { document.body.classList.remove("el-loading-parent--relative"); } catch {}    toast({ showClose: true, message: error, type: "error" });  }}

ARMS beacon sender

index.js
const armsConfig = {  key: "__bl",  regionMap: {    cn: "https://arms-retcode.aliyuncs.com/r.png?",    sg: "https://arms-retcode-sg.aliyuncs.com/r.png?",    us: "https://retcode-us-west-1.arms.aliyuncs.com/r.png?"  },  defaultImgUrl: "https://arms-retcode.aliyuncs.com/r.png?"};function sendArmsBeacon(payload, imgUrl) {  if (typeof payload === "object") {    payload = serialize(payload);  }  const url = imgUrl + payload;  if (window && window.navigator && typeof window.navigator.sendBeacon === "function") {    window.navigator.sendBeacon(url, "&post_res=");  } else {    warn("[arms] navigator.sendBeacon not surported");  }}
External services involved in the sign-in path
    • www.livepolls.app

    Receives the Chrome profile identifier and returns the extension passport used for later authenticated extension requests.

    • arms-retcode.aliyuncs.com

    Alibaba Cloud ARMS telemetry endpoint configured in the bundled browser-monitoring client.

What it can do

Permissions this extension asks for, as declared in version 2.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed Suno AI Music Generator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.livepolls.app

    Suno AI Music Generator sends data to www.livepolls.app. 15 other extensions we have analysed send data here.

  • arms-retcode.aliyuncs.com

    Suno AI Music Generator sends data to arms-retcode.aliyuncs.com. No other extension we have analysed sends data here.

Updated 30 September 2026bbmloghmgdfgncbgolceceokjmommobn