Is Universal Copy-Enable Copy safe?

Medium risk

Universal Copy sends the hostnames of sites you visit, plus your IP, country and a persistent ID, to its Aliyun logging server.

The extension re-enables copying and right-click on sites that block it, running on every http/https page. When you use its copy button, and again each time you return to a site you previously unlocked, the background worker logs an event to an Aliyun SLS logstore (hawkeye-us.us-west-1.log.aliyuncs.com) containing the page hostname or full active-tab URL joined to a persistent UUID. On install it resolves your public IP and country via ipinfo.io (falling back to cleartext http://ip-api.com) and attaches that to every later log record.

Allen Alexisv1.0.28Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Browsing context sent to Aliyun during copy and navigation

We observed this extension POSTing to an Aliyun SLS logstore.

The same sender fires on copy clicks and revisits to an unlocked site; the record includes hostname/tab URL, extension ID, IP, OS, country, language, version, install time.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You use the extension copy button or return to a site the extension has unlocked.

The content script sends copy-button events, and the background worker checks completed tab navigations against its saved site list.

The extension did this

The extension sends a log record that ties the page context to your browser and network details.

The record includes URL or hostname context, a persistent extension ID, IP address, operating system, country, language, version, and install time.

02EvidenceCORRESPONDENCE
Two code paths call the same Aliyun sender
WhenYou didExtension did
on click
user
You click the extension copy button on a web page.
content_script
The content script asks the background worker to send a copy event with the page hostname.
on completed navigation
user
You navigate to a site that is already in the extension's unlocked-site list.
service_worker
The background worker sends an automatic navigation event for that hostname.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/webcopy/track
Captured request body contained a __logs__ array with user_ip 2.58.72.153, UUID prefix 8e18b8da, operate_system Linux, region United Kingdom, and url chrome-extension://hmlmncgagbkggdfpklpmhjcmbjadpkdo/popup.html.
Headers
Content-Typeapplication/x-protobuf
x-log-apiversion0.6.0
04EvidenceFIELD TABLE
Fields assembled before the Aliyun POST
FieldValueWhy it matters
Active tab URL
chrome-extension://hmlmncgagbkggdfpklpmhjcmbjadpkdo/popup.htmlShows the page or extension view that was active when the event was recorded.
Visited-site hostname
docs.example.com (illustrative hostname)Shows which site was associated with a copy action or a repeat visit after the extension unlocked copying there.
Persistent extension ID
8e18b8da (captured UUID prefix)Lets repeated events from the same browser profile be linked together over time.
IP address and country
2.58.72.153 / United KingdomLinks the event to your network address and country-level location.
Browser and system details
Chrome, Linux, en-GBAdds device context that can separate your browser from other users with similar activity.
05EvidenceCODE COMPARE
The code that does this

Shipped code that builds and sends the browsing-context record

What it actually does
Aliyun SLS targetdeobfuscated/js/background.js
const A = {
  host: "us-west-1.log.aliyuncs.com",
  project: "hawkeye-us",
  logstore: "webcopy",
  time: .05,
  count: 1
};
Record builder and senderdeobfuscated/js/background.js
function I(t, e, r) {
  chrome.tabs.query({
    active: !0,
    currentWindow: !0
  }, i => {
    chrome.storage.local.get(["ipInfo", "install_time", "uid"], n => {
      var o, a, h, u;
      let l = {
        extension_name: "webcopy",
        version: chrome.runtime.getManifest().version,
        user_ip: (null === (o = n.ipInfo) || void 0 === o ? void 0 : o.ip) || (null === (a = n.ipInfo) || void 0 === a ? void 0 : a.query) || "",
        uuid: n.uid,
        install_time: n.install_time,
        event_time: Math.round((new Date).getTime() / 1e3).toString(),
        event_category: t || "",
        event_operate: e || "",
        event_tag: r || "",
        browser_type: chrome.runtime.getManifest().homepage_url.includes("chrome") ? "chrome" : "edge",
        operate_system: x(),
        region: (null === (h = n.ipInfo) || void 0 === h ? void 0 : h.country) || "",
        language: chrome.i18n.getUILanguage(),
        url: (null === (u = i[0]) || void 0 === u ? void 0 : u.url) || ""
      };
      const c = new s.a(A);
      c.send(l)
    })
  })
}
Repeat-navigation triggerdeobfuscated/js/background.js
chrome.tabs.onUpdated.addListener((async function(t, e, r) {
  var i = O(e.url || r.url);
  let n = await chrome.storage.local.get({
      hostList: []
    }),
    s = n.hostList || [];
  "complete" == e.status && (s.includes(i) ? (i && I("crack", "auto", i), M("on", t, i)) : B(t))
}));
Copy-button triggerdeobfuscated/js/content-script.js
function I(e, t, n) {
  chrome.runtime.sendMessage({
    action: "sendAli",
    type: e,
    control: t,
    lable: n
  }, (function(e) {}))
}
o()("body").on("click", "#clip_copy", (function() {
  I("copy", "button_copy", R(location.href)), chrome.runtime.sendMessage({
    action: "saveUseCount"
  })
}))
Aliyun SLS client POST pathdeobfuscated/js/background.js
var r = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";
var i = JSON.stringify({
  __logs__: e
});
let t = new Headers({
  "x-log-apiversion": "0.6.0",
  "x-log-bodyrawsize": i.length
});
let e = new Blob([i], {
  type: "application/x-protobuf"
});
t.append("Content-Type", "application/x-protobuf"), fetch(r, {
  method: "POST",
  headers: t,
  body: e
}).then(t => t)
06EvidenceTHIRD PARTY LIST
External destination receiving the event records
  • hawkeye-us.us-west-1.log.aliyuncs.com

    Aliyun Simple Log Service endpoint for the extension's webcopy logstore; receives the assembled event record.

  • ipinfo.io

    IP geolocation service used by the extension to populate IP and country fields before sending event records.

  • ip-api.com

    Fallback IP geolocation service used when the first IP lookup does not return usable data.

Data recipients

hawkeye-us.us-west-1.log.aliyuncs.comipinfo.ioip-api.com
Updated 17 September 2026hmlmncgagbkggdfpklpmhjcmbjadpkdo