Am I Being Pwned?
Get started

Is Simple Video Download Helper safe?

Medium risk

Simple Video Download Helper sends the current page URL and user API key to a third-party server when the popup is opened.

When the extension popup opens, it immediately transmits the active tab's URL to video.justyy.workers.dev along with the user's configured API key. The service worker also injects a content script into every active tab that reads the page's full DOM and URL, forwarding discovered video links to external resolvers including str.justyy.workers.dev and weibomiaopai.com. These transmissions occur automatically without explicit user confirmation each time.

https://weibomiaopai.com/download-video-parser.phpv3.2.1Chrome Web Store
45Risk
Who publishes it

https://weibomiaopai.com/download-video-parser.php - 5 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
https://weibomiaopai.com/download-video-parser.php
Website
weibomiaopai.com/download-video-parser.php

Same store account

5 other listings published from this account, 22k+ users between them, none of them carrying a finding.

Show My IP Addresses (External and Local)10k+CleanLogo Turtle Graphics4k+CleanSimplified/Traditional Chinese Converter4k+CleanQR Code Generator3k+CleanSimple Snake Game678Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup sends the current page URL to video.justyy.workers.dev

MediumunwantedCWE-359Dynamic sandbox

Saving a VIP server API key and opening the popup on a non-YouTube page reads the tab URL and builds a GET to video.justyy.workers.dev, URL in the video parameter, saved key in the hash parameter.

What actually happens

You did this

You open the extension popup after saving a VIP server API key.

The path applies to non-YouTube pages because the popup skips this branch for youtube.com.

The extension did this

The extension prepares a remote API request containing the active page URL.

The saved key string is also copied into the request's hash query parameter.

Query fields sent to the remote video API

  • Current page URL
    https://vimeo.com/123456789

    Shows the remote server which page you had open when you opened the popup.

  • Saved server key
    vip_test_key_123

    Links the request to the VIP server key saved in your extension settings.

  • Extension source tag
    simplevideodownloader

    Identifies this extension as the source of the server request.

  • Cache flag
    cached

    Tells the remote API to use its cached lookup mode for the submitted page URL.

Captured request

GEThttps://video.justyy.workers.dev/api/video/?cached&from=simplevideodownloader&video=https%3A%2F%2Fvimeo.com%2F123456789&hash=vip_test_key_123

GET request shape constructed by shipped code; no request body is used.

The code that does this

Popup code path that forwards the active tab URL

Readable version

Same behavior in plain terms

js/video.js
async function onPopupOpen() {    const tab = await chrome.tabs.query({ active: true, lastFocusedWindow: true }).then(([tab]) => tab);    const currentPageUrl = tab.url;    const domain = extractDomain(currentPageUrl).toLowerCase();    if (domain.includes('youtube.com') || !currentPageUrl.includes('http')) {        return;    }    const parserUrl = 'https://weibomiaopai.com/download-video-parser.php?url=' + encodeURIComponent(currentPageUrl);    renderParserUrlAndMaybeCallServer(parserUrl, currentPageUrl);}function renderParserUrlAndMaybeCallServer(parserUrl, currentPageUrl) {    const savedKey = $('input#key').val().trim();    if (!parserUrl.includes('weibomiaopai.com') || !savedKey) {        return;    }    const apiUrl = 'https://video.justyy.workers.dev/api/video/?cached&from=simplevideodownloader&video=' +        encodeURIComponent(currentPageUrl) + '&hash=' + savedKey;    fetch(apiUrl, { mode: 'cors' });}

External hosts in this path

    • video.justyy.workers.dev

    Receives the active tab URL and saved key parameter for the VIP server video parser API.

    • weibomiaopai.com

    Used as the visible parser URL that triggers the key-gated call to the remote API path.

What it can do

Permissions this extension asks for, as declared in version 3.0.25. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.2.1, which we have not unpacked yet.

  • Read and change your data on uploadbeta.com

    https://uploadbeta.com/api/*

  • Read and change your data on video.justyy.workers.dev

    https://video.justyy.workers.dev/api/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Video Download Helper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • str.justyy.workers.dev

    Video Download Helper sends data to str.justyy.workers.dev. No other extension we have analyzed sends data here.

  • video.justyy.workers.dev

    Video Download Helper sends data to video.justyy.workers.dev. No other extension we have analyzed sends data here.

  • weibomiaopai.com

    Video Download Helper sends data to weibomiaopai.com. No other extension we have analyzed sends data here.

Updated 30 September 2026ilcdiicigjaccgipndigcenjieedjohj