Am I Being Pwned?
Get started

Is TG Content Downloader - Telegram Downloader safe?

Medium risk

TG Content Downloader - Telegram Downloader is medium risk. TG Content Downloader posts an Alibaba Cloud SLS log entry with a persistent extension UUID, install timestamp, browser/system details, language, and active tab URL. The download handler adds the media URL and filename to the same log.

cocoouqv2.0.11Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Telegram downloader sends page and download details to Alibaba Cloud

MediumunwantedCWE-359Dynamic sandbox

TG Content Downloader posts an Alibaba Cloud SLS log entry with a persistent extension UUID, install timestamp, browser/system details, language, and active tab URL.

What actually happens

You did this

You download Telegram media with the extension.

The same logging helper is also called during install, update, and several dialog actions.

The extension did this

The extension posts a log entry about the event to Alibaba Cloud.

The entry includes a persistent extension UUID, install time, active tab URL, browser and system details, language, and download parameters when present.

Fields assembled for the Alibaba Cloud log entry

  • Persistent extension UUID
    e8cb7062-4a6f-4a5c-9a76-927d6d47b2b5

    This lets separate events from the same browser profile be connected over time.

  • Install timestamp
    1783860734

    This records when the extension profile was first initialized.

  • Active Telegram page
    https://web.telegram.org/k/#-1001234567890 (illustrative)

    This shows which Telegram web page was open when the event was logged.

  • Downloaded media reference
    url=blob:https://web.telegram.org/3f7a2b6c-9d0a-4b58-a2d9-632d0e7f17aa; filename=telegram-video-42 (illustrative)

    This links a download event to the media URL and filename handled by the extension.

  • Browser, system, and language
    browser_type=chrome; operate_system=Linux; language=en-US

    This adds device context that can distinguish one browser environment from another.

Captured request

POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/telegram-download/track

Dynamic analysis observed a POST whose request body contained a __logs__ entry with uuid=e8cb7062..., install_time=1783860734, browser_type=chrome, operate_system=Linux, and language=en-US.

Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0

The code that does this

The shipped code assembles the log entry and sends it to Alibaba Cloud SLS

Readable version

Readable SLS logger builds the POST URL and sends __logs__

js/background.js:2541-2574
key: "logger",value: async function(e = !1) {  var t = !1 !== e && e.length > 0 ? e : [];  if (0 !== t.length) {    var n = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";    try {      var r = JSON.stringify({        __logs__: t      });      let e = new Headers({        "x-log-apiversion": "0.6.0",        "x-log-bodyrawsize": r.length      });      if (this.compress) {        e.append("x-log-compresstype", "lz4");        var a = d.from(r),          s = o.encodeBound(r.length),          i = d.alloc(s),          u = o.encodeBlock(a, i);        i = i.slice(0, u), fetch(n, {          method: "POST",          headers: e,          body: i        }).then((e => e))      } else {        let t = new Blob([r], {          type: "application/x-protobuf"        });        e.append("Content-Type", "application/x-protobuf"), fetch(n, {          method: "POST",          headers: e,          body: t        }).then((e => e))      }    } catch (e) {}  }}

Readable background function adds active tab and stored profile fields

js/background.js:6617-6667
const c = {  host: "us-west-1.log.aliyuncs.com",  project: "hawkeye-us",  logstore: "telegram-download",  time: .05,  count: 1};function f(e, t = {}) {  chrome.storage.local.get(["ipInfo", "install_time", "uid", "userEmail"], (async n => {    var r;    const s = (await chrome.tabs.query({      active: !0,      currentWindow: !0    }))[0];    let i = {      extension_name: "telegram-download-vest1",      version: chrome.runtime.getManifest().version,      user_ip: "",      uuid: n.uid,      install_time: n.install_time,      event_time: Math.round((new Date).getTime() / 1e3).toString(),      event_category: e || "",      browser_type: -1 === navigator.userAgent.indexOf("Edg") ? "chrome" : "edge",      operate_system: h(),      region: (null === (r = n.ipInfo) || void 0 === r ? void 0 : r.country) || "",      email: n.userEmail || "",      language: chrome.i18n.getUILanguage(),      domain: null == s ? void 0 : s.url    };    const o = new a.a(c);    t && Object.assign(i, t), o.send(i)  }))}

Readable content script sends download URL and filename

js/teleram-contentScript.js:5215-5222
chrome.runtime.sendMessage({  action: "sendAliYun",  event: "download_" + i,  params: {    url: e,    filename: p  }})

External destination used by the logging path

    • hawkeye-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud SLS host that receives the extension's telegram-download logstore POST requests.

Updated 22 October 2026kijmncepdjeabghcjppndcgbogkfhbje