Is Private video downloader - Telegram Private Video Downloader safe?
Telegram Private Video Downloader sends Google OAuth access tokens to igtools.ai and transmits per-user telemetry to Aliyun on every download.
When users log in with Google, the extension captures the raw OAuth access token from the redirect URL and POSTs it to igtools.ai, a developer-controlled server. On every video download, popup open, and install event, the extension sends a telemetry payload — including a persistent UUID, user agent, email address (when logged in), and browser fingerprint — to an Alibaba Cloud logging endpoint. A remote configuration endpoint at gmplus.io also controls free download quotas and feature flags applied on each session.
Who publishes iteric-lyle-group - no other listings under this identity, 1 shared hostname
eric-lyle-group - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote config from gmplus.io controls download quota and feature flags
Opening the extension or logging in contacts gmplus.io for a config bundle setting your daily free-download quota and promo prompts.
Since it's a live endpoint, the developer can change your quota anytime, no Chrome Web Store update needed.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You install the extension, or log in or out through the popup.
The event fires on chrome.runtime.onInstalled and on auth state changes handled by the background service worker.
The extension fetches a configuration bundle from the developer's server and applies it to your local storage without displaying any notification.
The bundle can override your free download quota and toggle promotional prompts, all without any extension update.
Returns JSON {code: 100000, data: {config: [{id: '244', params: {freeUseCount: 3, activeRateExtensions: {'vest_gdfhmpjihkjpkcgfoclondnjlignnaap': false}, setDiscountExtensions: {...}}}]}}. Observed during dynamic analysis: two POSTs, both returning HTTP 200.
- Content-Type
- application/x-www-form-urlencoded
extension_id=35&language=enRemote config fetch and local state override (background.js)
// background.js lines 16902–16930var params = new URLSearchParams;params.append("extension_id", "35");params.append("language", "en");var { code, data: { config } } = await fetch( "https://gmplus.io/user/api-chrome-extension/get-remote-config", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: params }).then(r => r.json());// If server signals success (code === 100000), destructure and apply:if (code === 100000 && config.length > 0) { let { freeUseCount, activeRateExtensions, setDiscountExtensions } = config.filter(e => e.id === "244")[0].params; installinfo.freeUseCount = freeUseCount; // overrides local quota installinfo.hasActiveRate = activeRateExtensions["vest_gdfhmpjihkjpkcgfoclondnjlignnaap"]; installinfo.hasDiscountCode = setDiscountExtensions["vest_gdfhmpjihkjpkcgfoclondnjlignnaap"];}// Merged config written back and broadcast to all active tabs:chrome.storage.local.set({ installinfo });chrome.tabs.sendMessage(tab.id, { type: "set_user_info", get_user_info: { installinfo } });Set from the server response each login or install. The developer can zero freeUseCount or flip hasActiveRate anytime, no new version.
- Location
- chrome.storage.local key 'installinfo'
{ "plan_end": "-", "user_type": "Free", "plan_start": "-", "export_count": 3, "freeUseCount": 3, "hasActiveRate": false, "hasDiscountCode": false, "export_used_count": 0}- gmplus.io
Developer-operated backend. Receives the extension's fixed ID (35) and returns a config bundle that overwrites local usage quotas and feature-flag state on every auth event.
Where it sends data
Destinations our analysis observed Telegram Private Video Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- extension-us.us-west-1.log.aliyuncs.comwidely used
Telegram Private Video Downloader sends data to extension-us.us-west-1.log.aliyuncs.com. A widely used service: 27 other extensions we have analysed send data here.
- gmplus.io
Telegram Private Video Downloader sends data to gmplus.io. 2 other extensions we have analysed send data here.
- igtools.ai
Telegram Private Video Downloader sends data to igtools.ai. No other extension we have analysed sends data here.