Am I Being Pwned?
Get started

Is Universal Copy-Enable Copy safe?

Medium risk

Universal Copy sends the hostnames of sites you visit, plus your IP, country and a persistent ID, to its Aliyun logging server.

The extension re-enables copying and right-click on sites that block it, running on every http/https page. When you use its copy button, and again each time you return to a site you previously unlocked, the background worker logs an event to an Aliyun SLS logstore (hawkeye-us.us-west-1.log.aliyuncs.com) containing the page hostname or full active-tab URL joined to a persistent UUID. On install it resolves your public IP and country via ipinfo.io (falling back to cleartext http://ip-api.com) and attaches that to every later log record.

Allen Alexisv1.0.28Chrome Web Store
48Risk
Who publishes it

Allen Alexis - 4 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Allen Alexis

Same store account

4 other listings published from this account, 111k+ users between them. 2 of them carry a finding.

bilibili video downloader100k+MediumFlash Player Extension For Web10k+MediumChatSider:Free ChatGPT Assistant(GPT4)1k+LowTabtiby-Tab Manager460Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Browsing context sent to Aliyun during copy and navigation

MediumunwantedCWE-359Dynamic sandbox

We observed this extension POSTing to an Aliyun SLS logstore.

What actually happens

You did this

You use the extension copy button or return to a site the extension has unlocked.

The content script sends copy-button events, and the background worker checks completed tab navigations against its saved site list.

The extension did this

The extension sends a log record that ties the page context to your browser and network details.

The record includes URL or hostname context, a persistent extension ID, IP address, operating system, country, language, version, and install time.

Two code paths call the same Aliyun sender

  1. on click

    You did

    You click the extension copy button on a web page.

    The extension did

    The content script asks the background worker to send a copy event with the page hostname.

  2. on completed navigation

    You did

    You navigate to a site that is already in the extension's unlocked-site list.

    The extension did

    The background worker sends an automatic navigation event for that hostname.

Captured request

POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/webcopy/track

Captured request body contained a __logs__ array with user_ip 2.58.72.153, UUID prefix 8e18b8da, operate_system Linux, region United Kingdom, and url chrome-extension://hmlmncgagbkggdfpklpmhjcmbjadpkdo/popup.html.

Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0

Fields assembled before the Aliyun POST

  • Active tab URL
    chrome-extension://hmlmncgagbkggdfpklpmhjcmbjadpkdo/popup.html

    Shows the page or extension view that was active when the event was recorded.

  • Visited-site hostname
    docs.example.com (illustrative hostname)

    Shows which site was associated with a copy action or a repeat visit after the extension unlocked copying there.

  • Persistent extension ID
    8e18b8da (captured UUID prefix)

    Lets repeated events from the same browser profile be linked together over time.

  • IP address and country
    2.58.72.153 / United Kingdom

    Links the event to your network address and country-level location.

  • Browser and system details
    Chrome, Linux, en-GB

    Adds device context that can separate your browser from other users with similar activity.

The code that does this

Shipped code that builds and sends the browsing-context record

Readable version

Aliyun SLS target

deobfuscated/js/background.js
const A = {  host: "us-west-1.log.aliyuncs.com",  project: "hawkeye-us",  logstore: "webcopy",  time: .05,  count: 1};

Record builder and sender

deobfuscated/js/background.js
function I(t, e, r) {  chrome.tabs.query({    active: !0,    currentWindow: !0  }, i => {    chrome.storage.local.get(["ipInfo", "install_time", "uid"], n => {      var o, a, h, u;      let l = {        extension_name: "webcopy",        version: chrome.runtime.getManifest().version,        user_ip: (null === (o = n.ipInfo) || void 0 === o ? void 0 : o.ip) || (null === (a = n.ipInfo) || void 0 === a ? void 0 : a.query) || "",        uuid: n.uid,        install_time: n.install_time,        event_time: Math.round((new Date).getTime() / 1e3).toString(),        event_category: t || "",        event_operate: e || "",        event_tag: r || "",        browser_type: chrome.runtime.getManifest().homepage_url.includes("chrome") ? "chrome" : "edge",        operate_system: x(),        region: (null === (h = n.ipInfo) || void 0 === h ? void 0 : h.country) || "",        language: chrome.i18n.getUILanguage(),        url: (null === (u = i[0]) || void 0 === u ? void 0 : u.url) || ""      };      const c = new s.a(A);      c.send(l)    })  })}

Repeat-navigation trigger

deobfuscated/js/background.js
chrome.tabs.onUpdated.addListener((async function(t, e, r) {  var i = O(e.url || r.url);  let n = await chrome.storage.local.get({      hostList: []    }),    s = n.hostList || [];  "complete" == e.status && (s.includes(i) ? (i && I("crack", "auto", i), M("on", t, i)) : B(t))}));

Copy-button trigger

deobfuscated/js/content-script.js
function I(e, t, n) {  chrome.runtime.sendMessage({    action: "sendAli",    type: e,    control: t,    lable: n  }, (function(e) {}))}o()("body").on("click", "#clip_copy", (function() {  I("copy", "button_copy", R(location.href)), chrome.runtime.sendMessage({    action: "saveUseCount"  })}))

Aliyun SLS client POST path

deobfuscated/js/background.js
var r = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";var i = JSON.stringify({  __logs__: e});let t = new Headers({  "x-log-apiversion": "0.6.0",  "x-log-bodyrawsize": i.length});let e = new Blob([i], {  type: "application/x-protobuf"});t.append("Content-Type", "application/x-protobuf"), fetch(r, {  method: "POST",  headers: t,  body: e}).then(t => t)

External destination receiving the event records

    • hawkeye-us.us-west-1.log.aliyuncs.com

    Aliyun Simple Log Service endpoint for the extension's webcopy logstore; receives the assembled event record.

    • ipinfo.io

    IP geolocation service used by the extension to populate IP and country fields before sending event records.

    • ip-api.com

    Fallback IP geolocation service used when the first IP lookup does not return usable data.

What it can do

Permissions this extension asks for, as declared in version 1.0.28. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Universal Copy-Enable Copy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ip-api.comwidely used

    Universal Copy-Enable Copy sends data to ip-api.com. A widely used service: 73 other extensions we have analyzed send data here.

  • ipinfo.iowidely used

    Universal Copy-Enable Copy sends data to ipinfo.io. A widely used service: 53 other extensions we have analyzed send data here.

  • hawkeye-us.us-west-1.log.aliyuncs.com

    Universal Copy-Enable Copy sends data to hawkeye-us.us-west-1.log.aliyuncs.com. 20 other extensions we have analyzed send data here.

Updated 2 November 2026hmlmncgagbkggdfpklpmhjcmbjadpkdo