Is TelePlus - Multi-Accounts Sender safe?

Question

Accepted Answer

TelePlus - Multi-Accounts Sender is critical risk. When you sign in through the extension popup, the extension sends the Telegram phone number and one-time phone code entered in the login form to an Aliyun telemetry endpoint. The affected fields are credentials and form input, and the endpoint is extension-us.us-west-1.log.aliyuncs.com/logstores/scrm-tg-multi-sender/track. When you import an account in TelePlus - Multi-Accounts Sender, the extension accepts Telegram `.session` files that you select. It appends those raw session files to a POST request to `teleplus.io/client/upload-sessions`, transmitting credential material before local account records are created from the server response.

Is TelePlus - Multi-Accounts Sender safe?

Findings