Is TransTik – Your TikTok Language Assistant safe?

Medium risk

TransTik captures TikTok feed, search, like and favorite video lists and uploads them to kolsprite.com.

On tiktok.com the extension intercepts TikTok's own API responses for the For You feed, search, explore, tags, and a user's posts, reposts, likes and favorites. The full video lists are sent automatically to www.kolsprite.com as pages load or scroll, with no user action or consent prompt gating the upload.

v1.0.1Chrome Web Store
49Risk
Who publishes it

3 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

3 other listings published from this account, 4k+ users between them. 1 of them carries a finding.

TikTok Cleaner | Remove Likes & Reposts with One-Click4k+MediumCreator Insights – TikTok Creator Analysis, Simplifying Selection195LowTikTok Insights – Smart Sorting & Filtering83Low

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

mjjl.cn
Also called by 4 other listings, including SellerSprite, KOLSprite
o.kolsprite.com
Also called by 4 other listings, including SellerSprite, KOLSprite
kolsprite.com
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

TikTok feed, search, like and repost lists are posted to kolsprite.com

Code analysis shows the extension copies TikTok feed, search, like and repost API responses and posts them to kolsprite.com.

Nothing in the code asks for consent before the upload.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You scroll the For You feed, search, or open a profile, likes or reposts tab on tiktok.com.

No click on the extension is needed.

The extension did this

The extension sends the returned list of videos to www.kolsprite.com.

Each upload is a POST of the full item list.

The code that does this

Capture in the page, then upload from the content script

Readable version

Endpoints that trigger a capture

assets/inject.ts.js
window.__kol_captureList = {  "/api/recommend/item_list/": "foryouVideoList",  "/api/post/item_list": "userVideoList",  "/api/repost/item_list": "userRepostList",  "/api/favorite/item_list": "userLikeList",  "/api/collection/item_list": "userFavoriteList",  "/api/search/general/full": "searchVideoList",  "/api/search/item/full/": "searchVideoList",  "/api/explore/item_list/": "exploreVideoList",  "/api/challenge/item_list/": "tagVideoList"};

Listener that calls the upload

assets/content.ts.js
const creatorPageListener = (e2) => {  const o = e2.detail;  const result = o.itemList || o.item_list || o.user_list || ...;  if (result) {    ...    setTimeout(() => {      upLoadVideo(result, state.userInfo?.user?.region);    }, 500);  }};
What the upload carries, per code analysis
  • Videos you viewed or searched
    recommend/item_list: 30 video items

    The list returned for the feed, search or tab you opened.

  • Video authors
    author.uniqueId: example_creator

    Account details of each video author in the list.

  • Video stats
    stats.diggCount: 18200

    Play, like and share counts attached to each item.

  • Region
    ?region=US

    Optional region code added to the upload URL.

Destination of the upload
    • www.kolsprite.com

    Receives the TikTok item lists at /v1/plugin/video/label/add; also the extension's own login site.

Scope of this finding

This is a code-analysis finding. The extension's code contains no consent prompt before the upload. The cookie token path is not used for this call.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on tiktok.com

    *://*.tiktok.com/*

  • Read and change your data on kolsprite.com

    *://*.kolsprite.com/*

  • Read and change your data on bing.com

    *://*.bing.com/ttranslatev3/*

  • Read and change your data on tiktokcdn.com

    *://*.tiktokcdn.com/*

  • Read and change your data on tiktokcdn-eu.com

    *://*.tiktokcdn-eu.com/*

  • Read and change your data on tiktokcdn-us.com

    *://*.tiktokcdn-us.com/*

  • Read and change your data on tiktokv.com

    *://*.tiktokv.com/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed TransTik – Your TikTok Language Assistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.kolsprite.com

    TransTik – Your TikTok Language Assistant sends data to www.kolsprite.com. 4 other extensions we have analysed send data here.

Updated 15 October 2026jeeiefbmkbggbhhlejphoaikeodbhnga