Is TG Content Downloader - Telegram Downloader safe?

Medium risk

TG Content Downloader - Telegram Downloader is medium risk. TG Content Downloader posts an Alibaba Cloud SLS log entry with a persistent extension UUID, install timestamp, browser/system details, language, and active tab URL. The download handler adds the media URL and filename to the same log.

cocoouqv2.0.4Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Telegram downloader sends page and download details to Alibaba Cloud

TG Content Downloader posts an Alibaba Cloud SLS log entry with a persistent extension UUID, install timestamp, browser/system details, language, and active tab URL.

The download handler adds the media URL and filename to the same log.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You download Telegram media with the extension.

The same logging helper is also called during install, update, and several dialog actions.

The extension did this

The extension posts a log entry about the event to Alibaba Cloud.

The entry includes a persistent extension UUID, install time, active tab URL, browser and system details, language, and download parameters when present.

02EvidenceFIELD TABLE
Fields assembled for the Alibaba Cloud log entry
FieldValueWhy it matters
Persistent extension UUID
e8cb7062-4a6f-4a5c-9a76-927d6d47b2b5This lets separate events from the same browser profile be connected over time.
Install timestamp
1783860734This records when the extension profile was first initialized.
Active Telegram page
https://web.telegram.org/k/#-1001234567890 (illustrative)This shows which Telegram web page was open when the event was logged.
Downloaded media reference
url=blob:https://web.telegram.org/3f7a2b6c-9d0a-4b58-a2d9-632d0e7f17aa; filename=telegram-video-42 (illustrative)This links a download event to the media URL and filename handled by the extension.
Browser, system, and language
browser_type=chrome; operate_system=Linux; language=en-USThis adds device context that can distinguish one browser environment from another.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/telegram-download/track
Dynamic analysis observed a POST whose request body contained a __logs__ entry with uuid=e8cb7062..., install_time=1783860734, browser_type=chrome, operate_system=Linux, and language=en-US.
Headers
Content-Typeapplication/x-protobuf
x-log-apiversion0.6.0
04EvidenceCODE COMPARE
The code that does this

The shipped code assembles the log entry and sends it to Alibaba Cloud SLS

What it actually does
Readable SLS logger builds the POST URL and sends __logs__js/background.js:2541-2574
key: "logger",
value: async function(e = !1) {
  var t = !1 !== e && e.length > 0 ? e : [];
  if (0 !== t.length) {
    var n = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";
    try {
      var r = JSON.stringify({
        __logs__: t
      });
      let e = new Headers({
        "x-log-apiversion": "0.6.0",
        "x-log-bodyrawsize": r.length
      });
      if (this.compress) {
        e.append("x-log-compresstype", "lz4");
        var a = d.from(r),
          s = o.encodeBound(r.length),
          i = d.alloc(s),
          u = o.encodeBlock(a, i);
        i = i.slice(0, u), fetch(n, {
          method: "POST",
          headers: e,
          body: i
        }).then((e => e))
      } else {
        let t = new Blob([r], {
          type: "application/x-protobuf"
        });
        e.append("Content-Type", "application/x-protobuf"), fetch(n, {
          method: "POST",
          headers: e,
          body: t
        }).then((e => e))
      }
    } catch (e) {}
  }
}
Readable background function adds active tab and stored profile fieldsjs/background.js:6617-6667
const c = {
  host: "us-west-1.log.aliyuncs.com",
  project: "hawkeye-us",
  logstore: "telegram-download",
  time: .05,
  count: 1
};

function f(e, t = {}) {
  chrome.storage.local.get(["ipInfo", "install_time", "uid", "userEmail"], (async n => {
    var r;
    const s = (await chrome.tabs.query({
      active: !0,
      currentWindow: !0
    }))[0];
    let i = {
      extension_name: "telegram-download-vest1",
      version: chrome.runtime.getManifest().version,
      user_ip: "",
      uuid: n.uid,
      install_time: n.install_time,
      event_time: Math.round((new Date).getTime() / 1e3).toString(),
      event_category: e || "",
      browser_type: -1 === navigator.userAgent.indexOf("Edg") ? "chrome" : "edge",
      operate_system: h(),
      region: (null === (r = n.ipInfo) || void 0 === r ? void 0 : r.country) || "",
      email: n.userEmail || "",
      language: chrome.i18n.getUILanguage(),
      domain: null == s ? void 0 : s.url
    };
    const o = new a.a(c);
    t && Object.assign(i, t), o.send(i)
  }))
}
Readable content script sends download URL and filenamejs/teleram-contentScript.js:5215-5222
chrome.runtime.sendMessage({
  action: "sendAliYun",
  event: "download_" + i,
  params: {
    url: e,
    filename: p
  }
})
05EvidenceTHIRD PARTY LIST
External destination used by the logging path
  • hawkeye-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud SLS host that receives the extension's telegram-download logstore POST requests.

Updated 17 September 2026kijmncepdjeabghcjppndcgbogkfhbje