Is Alternate Player for Twitch.tv safe?

Medium risk

Alternate Player for Twitch.tv sends Twitch stream tokens, GPU fingerprint, and session logs to a third-party server over plain HTTP.

When a user triggers crash or feedback reporting, the extension collects Twitch stream access tokens, browser and system fingerprint data (GPU model, CPU count, RAM, screen geometry, timezone, language), and a rolling debug log of up to 1500 session entries. This data is POSTed without TLS to r90354g8.beget.tech, a Russian hosting provider, via a hard-coded endpoint in player.js.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Alexander Choporov (CoolCmd)v2025.6.16Firefox Add-ons
44Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 2025.6.16. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on twitch.tv

    *://*.twitch.tv/*

  • Read and change your data on twitchcdn.net

    *://*.twitchcdn.net/*

  • Read and change your data on ttvnw.net

    *://*.ttvnw.net/*

  • Read and change your data on jtvnw.net

    *://*.jtvnw.net/*

  • Read and change your data on live-video.net

    *://*.live-video.net/*

  • Read and change your data on akamaized.net

    *://*.akamaized.net/*

  • Read and change your data on cloudfront.net

    *://*.cloudfront.net/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Watch every request your browser makes

    webRequest

  • Watch, block and rewrite every request your browser makes

    webRequestBlocking

  • Write to your clipboard

    clipboardWrite

Where it sends data

Destinations our analysis observed twitch_5 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • r90354g8.beget.tech

    twitch_5 sends data to r90354g8.beget.tech. One other extension we have analyzed sends data here.

Updated 22 October 2026amo-707675