Is Simple Video Download Helper safe?
Simple Video Download Helper sends the current page URL and user API key to a third-party server when the popup is opened.
When the extension popup opens, it immediately transmits the active tab's URL to video.justyy.workers.dev along with the user's configured API key. The service worker also injects a content script into every active tab that reads the page's full DOM and URL, forwarding discovered video links to external resolvers including str.justyy.workers.dev and weibomiaopai.com. These transmissions occur automatically without explicit user confirmation each time.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup sends the current page URL to video.justyy.workers.dev
Saving a VIP server API key and opening the popup on a non-YouTube page reads the tab URL and builds a GET to video.justyy.workers.dev, URL in the video parameter, saved key in the hash parameter.
Dynamic traffic didn't exercise this path.
You open the extension popup after saving a VIP server API key.
The path applies to non-YouTube pages because the popup skips this branch for youtube.com.
The extension prepares a remote API request containing the active page URL.
The saved key string is also copied into the request's hash query parameter.
| Field | Value | Why it matters | |
|---|---|---|---|
Current page URL | https://vimeo.com/123456789 | Shows the remote server which page you had open when you opened the popup. | |
Saved server key | vip_test_key_123 | Links the request to the VIP server key saved in your extension settings. | |
Extension source tag | simplevideodownloader | Identifies this extension as the source of the server request. | |
Cache flag | cached | Tells the remote API to use its cached lookup mode for the submitted page URL. |
Popup code path that forwards the active tab URL
async function onPopupOpen() {
const tab = await chrome.tabs.query({ active: true, lastFocusedWindow: true }).then(([tab]) => tab);
const currentPageUrl = tab.url;
const domain = extractDomain(currentPageUrl).toLowerCase();
if (domain.includes('youtube.com') || !currentPageUrl.includes('http')) {
return;
}
const parserUrl = 'https://weibomiaopai.com/download-video-parser.php?url=' + encodeURIComponent(currentPageUrl);
renderParserUrlAndMaybeCallServer(parserUrl, currentPageUrl);
}
function renderParserUrlAndMaybeCallServer(parserUrl, currentPageUrl) {
const savedKey = $('input#key').val().trim();
if (!parserUrl.includes('weibomiaopai.com') || !savedKey) {
return;
}
const apiUrl = 'https://video.justyy.workers.dev/api/video/?cached&from=simplevideodownloader&video=' +
encodeURIComponent(currentPageUrl) + '&hash=' + savedKey;
fetch(apiUrl, { mode: 'cors' });
}- video.justyy.workers.dev
Receives the active tab URL and saved key parameter for the VIP server video parser API.
- weibomiaopai.com
Used as the visible parser URL that triggers the key-gated call to the remote API path.