Is 云链 - Tiktok视频下载 safe?
The TikTok downloader sends the URL and host of every page you visit to plug2025.bm-com.com.
A content script runs on all websites, not only TikTok, and on each page load sends the page URL and host to the extension's backend. The request also carries a stored user ID, session ID and paid-user status. This is unrelated to the TikTok video download feature.
Who publishes itDo It - 7 other listings from the same operator, 6 of them carrying a finding
Do It - 7 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 1k+ users between them. 6 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
TikTok downloader sends the address of every page you open to a remote server
Code analysis shows a script on all sites passes each page's address and host to the extension, which posts them with a stored user ID to plug2025.bm-com.com, though downloads only concern TikTok.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open any web page, such as a news site or a search results page.
The extension reports that page's full address to plug2025.bm-com.com.
The address is sent together with an ID that stays the same between visits.
Content script and background handler that forward the page URL
Background message handler
js/background.jscase "recordVisitor": F(e.fromChannel, e.host, e.url), t({ success: !0 }); break;Function F builds and sends the record
js/background.jsfunction F(e = "popup", o, t) { chrome.storage.local.get(["userId", "sessionId", "paidUsers"], function(s) { s.sessionId || (s.sessionId = Math.random().toString(36).substr(2, 10), chrome.storage.local.set({ sessionId: s.sessionId })), h.recordVisitor({ userId: s.userId, fromChannel: e, sessionId: s.sessionId, host: o, url: t, paidUsers: s.paidUsers }).catch(a => console.log("Error:", a)) })}- Page URLhttps://example.com/account/orders?id=48213
The full address of the page you are on, including any query string.
- Hostexample.com
The site you are visiting.
- User IDu_83b2f1c4
A stored ID that links requests to the same installation, set if you log in.
- Session IDk3j9x0a2qd
A random 10 character ID created once and reused for later requests.
- Channelcontent
Marks that the report came from the page script.
- Paid statusfalse
Whether the install is flagged as a paying user.
- plug2025.bm-com.com
Receives the URL, host and IDs via POST /api/visitor/visitorRecord; same backend as two sibling extensions.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed 云链 - Tiktok视频下载 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- plug2025.bm-com.com
云链 - Tiktok视频下载 sends data to plug2025.bm-com.com. 11 other extensions we have analysed send data here.