Is TG DownloadHelper - Telegram Video Download safe?

Medium risk

TG DownloadHelper transmits the active tab URL, user email, and a persistent UUID to Alibaba Cloud on install, update, and each download action.

On install and update, and each time a user triggers a download, the extension collects the current tab URL, a stored user email address, a persistent UUID, and OS and browser metadata, then posts this data to an Alibaba Cloud logging endpoint. Download events also include the video URL and filename. The telemetry is sent via the background service worker to hawkeye-us.us-west-1.log.aliyuncs.com.

dakshxnumdv2.4.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Active Tab URL, Email, and Persistent ID Sent to Alibaba Cloud on Every Event

Installing this extension assigns a tracking ID, sent to Alibaba Cloud with the address of your current tab, not just Telegram tabs.

This fires on install and each popup open, with no on-screen sign, and includes your email if logged in.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension, or simply open its popup while browsing.

No further action is required, the telemetry call fires automatically on install/update and again on every popup open.

The extension did this

Reads a persistent device ID and your current tab address, and sends both, plus OS, browser type, and email if logged in, to an Alibaba Cloud logging endpoint.

The same function runs again whenever the extension's content script sends a download-triggered message to the background.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/telegram-download/track
Captured during dynamic analysis; the request fired automatically when the extension popup was opened, with no consent prompt shown.
Body
{
  "extension_name": "telegram-download",
  "version": "2.4.3",
  "uuid": "5b6ffbde-de44-4af6-a158-75a4981f1e6c",
  "install_time": "1783302625",
  "event_time": "1783302733",
  "event_category": "open_popup",
  "browser_type": "chrome",
  "operate_system": "Linux",
  "region": "",
  "email": "",
  "language": "en-US",
  "domain": "https://web.telegram.org/k/"
}
03EvidenceFIELD TABLE
Fields included in every telemetry event
FieldValueWhy it matters
Persistent device ID
5b6ffbde-de44-4af6-a158-75a4981f1e6cA unique identifier generated for your browser on first install. It stays the same across sessions and links every future event back to you.
Current tab address
https://web.telegram.org/k/The full web address of whatever page you have open at the moment the event fires, not limited to Telegram pages.
Account email
(blank until you log in; populated afterward)If you've logged into the extension, your email address is attached to every event sent after that.
Operating system
LinuxThe platform detected from your browser, e.g. Windows, Mac, or Linux.
Browser type
chromeWhether you're using Chrome or Edge.
Install timestamp
1783302625Unix timestamp of when you first installed the extension; sent unchanged with every event.
Event type
open_popupWhat triggered this particular event, install, update, opening the popup, or downloading a video.
04EvidenceCODE COMPARE
The code that does this

Telemetry function and its triggers in background.js

What it actually does
Telemetry builder — readable formjs/background.js
// Aliyun SLS logger config
const slsConfig = {
  host: 'us-west-1.log.aliyuncs.com',
  project: 'hawkeye-us',
  logstore: 'telegram-download',
  time: 0.05,
  count: 1          // flush immediately, no batching
};

function sendTelemetryEvent(eventCategory, extraParams = {}) {
  chrome.storage.local.get(['ipInfo', 'install_time', 'uid', 'userEmail'], async (stored) => {
    const activeTab = (await chrome.tabs.query({ active: true, currentWindow: true }))[0];
    const record = {
      extension_name: 'telegram-download',
      version: chrome.runtime.getManifest().version,
      user_ip: '',
      uuid: stored.uid,                              // persistent device ID
      install_time: stored.install_time,
      event_time: Math.round(Date.now() / 1000).toString(),
      event_category: eventCategory || '',
      browser_type: navigator.userAgent.includes('Edg') ? 'edge' : 'chrome',
      operate_system: detectOS(),
      region: stored.ipInfo?.country || '',
      email: stored.userEmail || '',                 // populated once logged in
      language: chrome.i18n.getUILanguage(),
      domain: activeTab?.url                          // URL of whatever tab is active right now
    };
    if (extraParams) Object.assign(record, extraParams);
    new SlsLogger(slsConfig).send(record);
  });
}
Triggers — readable formjs/background.js
chrome.runtime.onInstalled.addListener(async (details) => {
  // ... assigns a persistent uid if one doesn't already exist ...
  const manifest = chrome.runtime.getManifest();
  if (details.reason === 'install') {
    sendTelemetryEvent('install', { version: manifest.version });
  } else if (details.reason === 'update') {
    sendTelemetryEvent('update', { version: manifest.version });
  }
});

chrome.runtime.onMessage.addListener((message) => {
  if (message.action === 'sendAliYun') {
    sendTelemetryEvent(message.event, message.params);
  }
  // ... other message handlers (pricing page, login, etc.) ...
});
05EvidenceTHIRD PARTY LIST
Data destination
  • hawkeye-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud Log Service, logstore telegram-download, project hawkeye-us. Receives device ID, tab URL, browser/OS info, and email on install, update, popup open, and downloads.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Telegram download URLs are posted to Alibaba Cloud

Clicking the Telegram media download button puts the media URL and filename in a logging payload, POSTed to hawkeye-us.us-west-1.log.aliyuncs.com, an Alibaba Cloud endpoint.

No live body was captured; the session lacked a logged-in chat.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click the extension's download button on a Telegram media item.

The code path is tied to the extension's video or music download handling.

The extension did this

The extension sends a logging event that includes the media URL and derived filename.

The background script merges those fields into a payload for Alibaba Cloud Log Service.

02EvidenceFIELD TABLE
Fields added to the Alibaba Cloud logging payload
FieldValueWhy it matters
Downloaded media URL
https://cdn4.telegram-cdn.org/file/1a2b3c4d/video_998877.mp4 (illustrative)Lets the logging endpoint receive the exact Telegram media resource associated with the download.
Derived filename or video ID
BAADBAADbQADBREAAV8n0wqfK6b4Ag.mp4 (illustrative)Adds a stable label for the downloaded item, so the logging endpoint can distinguish one media file from another.
Active page URL
https://web.telegram.org/k/#-1001234567890 (illustrative)Shows which Telegram Web page was active when the download event was logged.
Download event name
download_videoMarks the log entry as a video or music download rather than a generic extension event.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/telegram-download/track
Headers
Content-Typeapplication/x-protobuf
x-log-apiversion0.6.0
04EvidenceCODE COMPARE
The code that does this

The download handler and background logger join the media fields to the POST

What it actually does
Readable content script download handlerdeobfuscated/js/content-script-teleram.js
j = async (t, e, n, r, o, a) => {
  if (e.includes("stream/") || e.includes("blob:") || e.includes("progressive/")) {
    var s;
    null == T && (T = await chrome.storage.local.get(["installinfo"]));
    let {
      export_used_count: c
    } = T.installinfo || 0, u = 0;
    const l = 500;
    let m = (new Date).getTime();
    if (m - u < l) return;
    u = m;
    let g = "";
    const v = (null === (s = a.querySelector(f)) || void 0 === s ? void 0 : s.innerText) || "";
    if ("video" === o && "GIF" !== v)
      if (e.indexOf("stream/") > -1) {
        const t = e.indexOf("stream/") + 7,
          n = e.substring(t),
          r = decodeURIComponent(n);
        g = JSON.parse(r).location.id
      } else if (e.includes("progressive/") || e.includes("blob:")) g = r;
    else {
      let t = document.querySelectorAll("div.media-viewer-whole")[0].querySelectorAll(".media-viewer-buttons .btn-icon")[2];
      await p(t), await d()
    }
    document.addEventListener(g + "_video_download_progress", (t => {
      const e = a.querySelector(".down_btn_progress"),
        n = a.querySelector(".down_btn_video"),
        r = a.querySelector(".check-all-download");
      if (null !== t.detail.progress && "100.00" !== t.detail.progress && null !== a) {
        let o = null;
        null !== n && (n.style.display = "none", o = t.detail.progress), null !== r && (r.style.display = "none", o = Math.max(-1, parseInt(t.detail.progress))), null === e ? a.appendChild(function() {
          const t = document.createElement("div");
          t.className = "progress-teleram-script";
          const e = document.createElement("div");
          return e.className = "content-teleram-script  down_btn_progress", t.appendChild(e), t
        }()) : (e.style.display = "block", e.innerHTML = `${i.a.t("dialog.progressText")} ${o}%`)
      } else null !== n && (n.style.display = "block"), null !== r && (r.style.display = "flex"), e.style.display = "none"
    }));
    const y = new CustomEvent("video_download", {
      detail: {
        type: t,
        video_src: {
          video_url: e,
          video_id: g,
          page: n,
          download_id: r
        }
      }
    });
    if (document.dispatchEvent(y), "music" === o) {
      let t = a.getElementsByClassName("audio-play-icon")[0];
      await p(t), a.querySelector(".down_btn_music").innerHTML = "DOWNLOAD"
    }
    chrome.runtime.sendMessage({
      action: "sendAliYun",
      event: "download_" + o,
      params: {
        url: e,
        filename: g
      }
    }), c += 1, h({
      type: "limitUsedCount",
      message: c
    })
  }
}
Readable background payload mergerdeobfuscated/js/background.js
function W(e, t = {}) {
  chrome.storage.local.get(["ipInfo", "install_time", "uid", "userEmail"], (async n => {
    var r;
    const a = (await chrome.tabs.query({
      active: !0,
      currentWindow: !0
    }))[0];
    let i = {
      extension_name: "telegram-download",
      version: chrome.runtime.getManifest().version,
      user_ip: "",
      uuid: n.uid,
      install_time: n.install_time,
      event_time: Math.round((new Date).getTime() / 1e3).toString(),
      event_category: e || "",
      browser_type: -1 === navigator.userAgent.indexOf("Edg") ? "chrome" : "edge",
      operate_system: C(),
      region: (null === (r = n.ipInfo) || void 0 === r ? void 0 : r.country) || "",
      email: n.userEmail || "",
      language: chrome.i18n.getUILanguage(),
      domain: null == a ? void 0 : a.url
    };
    const o = new s.a(P);
    t && Object.assign(i, t), o.send(i)
  }))
}
Readable Alibaba Cloud POST senderdeobfuscated/js/background.js
logger: async function(e = !1) {
  var t = !1 !== e && e.length > 0 ? e : [];
  if (0 !== t.length) {
    var n = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";
    try {
      var r = JSON.stringify({
        __logs__: t
      });
      let e = new Headers({
        "x-log-apiversion": "0.6.0",
        "x-log-bodyrawsize": r.length
      });
      if (this.compress) {
        e.append("x-log-compresstype", "lz4");
        var a = d.from(r),
          s = o.encodeBound(r.length),
          i = d.alloc(s),
          u = o.encodeBlock(a, i);
        i = i.slice(0, u), fetch(n, {
          method: "POST",
          headers: e,
          body: i
        }).then((e => e))
      } else {
        let t = new Blob([r], {
          type: "application/x-protobuf"
        });
        e.append("Content-Type", "application/x-protobuf"), fetch(n, {
          method: "POST",
          headers: e,
          body: t
        }).then((e => e))
      }
    } catch (e) {}
  }
}
05EvidenceTHIRD PARTY LIST
External destination reached by the logger
  • hawkeye-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud Log Service endpoint for the extension's telegram-download project/logstore.

Data recipients

hawkeye-us.us-west-1.log.aliyuncs.com
Updated 17 September 2026pnekmfnjbjaddedaednmgegopfcekael