Is TG DownloadHelper - Telegram Video Download safe?
TG DownloadHelper transmits the active tab URL, user email, and a persistent UUID to Alibaba Cloud on install, update, and each download action.
On install and update, and each time a user triggers a download, the extension collects the current tab URL, a stored user email address, a persistent UUID, and OS and browser metadata, then posts this data to an Alibaba Cloud logging endpoint. Download events also include the video URL and filename. The telemetry is sent via the background service worker to hawkeye-us.us-west-1.log.aliyuncs.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Active Tab URL, Email, and Persistent ID Sent to Alibaba Cloud on Every Event
Installing this extension assigns a tracking ID, sent to Alibaba Cloud with the address of your current tab, not just Telegram tabs.
This fires on install and each popup open, with no on-screen sign, and includes your email if logged in.
You install the extension, or simply open its popup while browsing.
No further action is required, the telemetry call fires automatically on install/update and again on every popup open.
Reads a persistent device ID and your current tab address, and sends both, plus OS, browser type, and email if logged in, to an Alibaba Cloud logging endpoint.
The same function runs again whenever the extension's content script sends a download-triggered message to the background.
{
"extension_name": "telegram-download",
"version": "2.4.3",
"uuid": "5b6ffbde-de44-4af6-a158-75a4981f1e6c",
"install_time": "1783302625",
"event_time": "1783302733",
"event_category": "open_popup",
"browser_type": "chrome",
"operate_system": "Linux",
"region": "",
"email": "",
"language": "en-US",
"domain": "https://web.telegram.org/k/"
}| Field | Value | Why it matters | |
|---|---|---|---|
Persistent device ID | 5b6ffbde-de44-4af6-a158-75a4981f1e6c | A unique identifier generated for your browser on first install. It stays the same across sessions and links every future event back to you. | |
Current tab address | https://web.telegram.org/k/ | The full web address of whatever page you have open at the moment the event fires, not limited to Telegram pages. | |
Account email | (blank until you log in; populated afterward) | If you've logged into the extension, your email address is attached to every event sent after that. | |
Operating system | Linux | The platform detected from your browser, e.g. Windows, Mac, or Linux. | |
Browser type | chrome | Whether you're using Chrome or Edge. | |
Install timestamp | 1783302625 | Unix timestamp of when you first installed the extension; sent unchanged with every event. | |
Event type | open_popup | What triggered this particular event, install, update, opening the popup, or downloading a video. |
Telemetry function and its triggers in background.js
// Aliyun SLS logger config
const slsConfig = {
host: 'us-west-1.log.aliyuncs.com',
project: 'hawkeye-us',
logstore: 'telegram-download',
time: 0.05,
count: 1 // flush immediately, no batching
};
function sendTelemetryEvent(eventCategory, extraParams = {}) {
chrome.storage.local.get(['ipInfo', 'install_time', 'uid', 'userEmail'], async (stored) => {
const activeTab = (await chrome.tabs.query({ active: true, currentWindow: true }))[0];
const record = {
extension_name: 'telegram-download',
version: chrome.runtime.getManifest().version,
user_ip: '',
uuid: stored.uid, // persistent device ID
install_time: stored.install_time,
event_time: Math.round(Date.now() / 1000).toString(),
event_category: eventCategory || '',
browser_type: navigator.userAgent.includes('Edg') ? 'edge' : 'chrome',
operate_system: detectOS(),
region: stored.ipInfo?.country || '',
email: stored.userEmail || '', // populated once logged in
language: chrome.i18n.getUILanguage(),
domain: activeTab?.url // URL of whatever tab is active right now
};
if (extraParams) Object.assign(record, extraParams);
new SlsLogger(slsConfig).send(record);
});
}chrome.runtime.onInstalled.addListener(async (details) => {
// ... assigns a persistent uid if one doesn't already exist ...
const manifest = chrome.runtime.getManifest();
if (details.reason === 'install') {
sendTelemetryEvent('install', { version: manifest.version });
} else if (details.reason === 'update') {
sendTelemetryEvent('update', { version: manifest.version });
}
});
chrome.runtime.onMessage.addListener((message) => {
if (message.action === 'sendAliYun') {
sendTelemetryEvent(message.event, message.params);
}
// ... other message handlers (pricing page, login, etc.) ...
});- hawkeye-us.us-west-1.log.aliyuncs.com
Alibaba Cloud Log Service, logstore telegram-download, project hawkeye-us. Receives device ID, tab URL, browser/OS info, and email on install, update, popup open, and downloads.
Telegram download URLs are posted to Alibaba Cloud
Clicking the Telegram media download button puts the media URL and filename in a logging payload, POSTed to hawkeye-us.us-west-1.log.aliyuncs.com, an Alibaba Cloud endpoint.
No live body was captured; the session lacked a logged-in chat.
You click the extension's download button on a Telegram media item.
The code path is tied to the extension's video or music download handling.
The extension sends a logging event that includes the media URL and derived filename.
The background script merges those fields into a payload for Alibaba Cloud Log Service.
| Field | Value | Why it matters | |
|---|---|---|---|
Downloaded media URL | https://cdn4.telegram-cdn.org/file/1a2b3c4d/video_998877.mp4 (illustrative) | Lets the logging endpoint receive the exact Telegram media resource associated with the download. | |
Derived filename or video ID | BAADBAADbQADBREAAV8n0wqfK6b4Ag.mp4 (illustrative) | Adds a stable label for the downloaded item, so the logging endpoint can distinguish one media file from another. | |
Active page URL | https://web.telegram.org/k/#-1001234567890 (illustrative) | Shows which Telegram Web page was active when the download event was logged. | |
Download event name | download_video | Marks the log entry as a video or music download rather than a generic extension event. |
| Content-Type | application/x-protobuf |
| x-log-apiversion | 0.6.0 |
The download handler and background logger join the media fields to the POST
j = async (t, e, n, r, o, a) => {
if (e.includes("stream/") || e.includes("blob:") || e.includes("progressive/")) {
var s;
null == T && (T = await chrome.storage.local.get(["installinfo"]));
let {
export_used_count: c
} = T.installinfo || 0, u = 0;
const l = 500;
let m = (new Date).getTime();
if (m - u < l) return;
u = m;
let g = "";
const v = (null === (s = a.querySelector(f)) || void 0 === s ? void 0 : s.innerText) || "";
if ("video" === o && "GIF" !== v)
if (e.indexOf("stream/") > -1) {
const t = e.indexOf("stream/") + 7,
n = e.substring(t),
r = decodeURIComponent(n);
g = JSON.parse(r).location.id
} else if (e.includes("progressive/") || e.includes("blob:")) g = r;
else {
let t = document.querySelectorAll("div.media-viewer-whole")[0].querySelectorAll(".media-viewer-buttons .btn-icon")[2];
await p(t), await d()
}
document.addEventListener(g + "_video_download_progress", (t => {
const e = a.querySelector(".down_btn_progress"),
n = a.querySelector(".down_btn_video"),
r = a.querySelector(".check-all-download");
if (null !== t.detail.progress && "100.00" !== t.detail.progress && null !== a) {
let o = null;
null !== n && (n.style.display = "none", o = t.detail.progress), null !== r && (r.style.display = "none", o = Math.max(-1, parseInt(t.detail.progress))), null === e ? a.appendChild(function() {
const t = document.createElement("div");
t.className = "progress-teleram-script";
const e = document.createElement("div");
return e.className = "content-teleram-script down_btn_progress", t.appendChild(e), t
}()) : (e.style.display = "block", e.innerHTML = `${i.a.t("dialog.progressText")} ${o}%`)
} else null !== n && (n.style.display = "block"), null !== r && (r.style.display = "flex"), e.style.display = "none"
}));
const y = new CustomEvent("video_download", {
detail: {
type: t,
video_src: {
video_url: e,
video_id: g,
page: n,
download_id: r
}
}
});
if (document.dispatchEvent(y), "music" === o) {
let t = a.getElementsByClassName("audio-play-icon")[0];
await p(t), a.querySelector(".down_btn_music").innerHTML = "DOWNLOAD"
}
chrome.runtime.sendMessage({
action: "sendAliYun",
event: "download_" + o,
params: {
url: e,
filename: g
}
}), c += 1, h({
type: "limitUsedCount",
message: c
})
}
}function W(e, t = {}) {
chrome.storage.local.get(["ipInfo", "install_time", "uid", "userEmail"], (async n => {
var r;
const a = (await chrome.tabs.query({
active: !0,
currentWindow: !0
}))[0];
let i = {
extension_name: "telegram-download",
version: chrome.runtime.getManifest().version,
user_ip: "",
uuid: n.uid,
install_time: n.install_time,
event_time: Math.round((new Date).getTime() / 1e3).toString(),
event_category: e || "",
browser_type: -1 === navigator.userAgent.indexOf("Edg") ? "chrome" : "edge",
operate_system: C(),
region: (null === (r = n.ipInfo) || void 0 === r ? void 0 : r.country) || "",
email: n.userEmail || "",
language: chrome.i18n.getUILanguage(),
domain: null == a ? void 0 : a.url
};
const o = new s.a(P);
t && Object.assign(i, t), o.send(i)
}))
}logger: async function(e = !1) {
var t = !1 !== e && e.length > 0 ? e : [];
if (0 !== t.length) {
var n = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";
try {
var r = JSON.stringify({
__logs__: t
});
let e = new Headers({
"x-log-apiversion": "0.6.0",
"x-log-bodyrawsize": r.length
});
if (this.compress) {
e.append("x-log-compresstype", "lz4");
var a = d.from(r),
s = o.encodeBound(r.length),
i = d.alloc(s),
u = o.encodeBlock(a, i);
i = i.slice(0, u), fetch(n, {
method: "POST",
headers: e,
body: i
}).then((e => e))
} else {
let t = new Blob([r], {
type: "application/x-protobuf"
});
e.append("Content-Type", "application/x-protobuf"), fetch(n, {
method: "POST",
headers: e,
body: t
}).then((e => e))
}
} catch (e) {}
}
}- hawkeye-us.us-west-1.log.aliyuncs.com
Alibaba Cloud Log Service endpoint for the extension's telegram-download project/logstore.