Is Video Downloader Unlimited safe?

#!/usr/bin/env node
// vdu-decrypt-payload.js
// Decrypts POST bodies from loader-unlim.com/api/collect.php sent by
// Video Downloader Unlimited (mkjjckchdfhjbpckippbnipkdnlidbeb).
//
// Usage:
//   node vdu-decrypt-payload.js '<base64-data-field-value>'
//
// The 'data' field value comes from the POST body JSON:
//   { "data": "<base64 AES-GCM payload>" }
//
// No dependencies — uses Node.js built-in crypto.webcrypto.

const { subtle } = require('crypto').webcrypto;

// Hardcoded AES-GCM key from serviceWorker.js encryptData() at line ~198.
const KEY_STR = 'tzMx9B4xf183Yv2B';

async function decrypt(b64) {
  const enc = new TextEncoder();
  const key = await subtle.importKey(
    'raw',
    enc.encode(KEY_STR),
    'AES-GCM',
    true,
    ['decrypt']
  );

  // Decode base64 to Buffer
  const buf = Buffer.from(b64, 'base64');

  // The extension prepends a 16-byte random IV before the ciphertext.
  const iv = buf.slice(0, 16);
  const ciphertext = buf.slice(16);

  const plaintext = await subtle.decrypt(
    { name: 'AES-GCM', iv },
    key,
    ciphertext
  );

  return new TextDecoder().decode(plaintext);
}

const input = process.argv[2];
if (!input) {
  console.error('Usage: node vdu-decrypt-payload.js <base64-data-field>');
  process.exit(1);
}

decrypt(input)
  .then(plain => {
    console.log('Decrypted payload:');
    console.log(JSON.stringify(JSON.parse(plain), null, 2));
  })
  .catch(err => {
    console.error('Decryption failed:', err.message);
    process.exit(1);
  });