Is Free Vimeo™ Downloader safe?

Medium risk

Free Vimeo Downloader sends a persistent UUID and usage events to Alibaba Cloud logging infrastructure on install and download actions.

On installation, the extension generates a unique identifier and stores it locally, then transmits it alongside browser language, OS platform, and event details to an Alibaba Cloud log endpoint on install, update, version check, and each download. A content script with broad page access runs a polling loop on every website the user visits to detect Vimeo player elements, though it does not send data from non-Vimeo pages.

alexwilliam63541v1.0.8Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

UUID telemetry sent to Alibaba Cloud on every install and update

On install or update, the extension generates a permanent device ID and sends it with browser language, OS, and timestamp to a logging service run by Alibaba Cloud.

DA captured four such POSTs pre-interaction, linking events to your device.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the Free Vimeo Downloader extension.

No further interaction is needed, the telemetry fires before you open the extension popup.

The extension did this

The extension assigns you a permanent UUID and sends it to Alibaba Cloud's logging infrastructure.

The payload includes your browser language, operating system platform, and the exact install timestamp, all sent as a protobuf-encoded POST without any consent prompt.

Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/vimeo_tool/track

HTTP 200 OK, event recorded in Alibaba Cloud SLS logstore vimeo_tool.

Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0
x-log-bodyrawsize
312
Body
{  "__logs__": [    {      "extension_name": "vimeo_tool",      "version": "1.0.6",      "uuid": "be105ecd-9681-44c6-bb04-be3e171617d8",      "install_time": "1780730075",      "event_time": "1780730178",      "event_category": "Version",      "event_operate": "",      "event_tag": "",      "browser_type": "chrome",      "operate_system": "Mac",      "language": "en-US"    }  ]}
Fields transmitted in every telemetry event
  • Device UUID
    be105ecd-9681-44c6-bb04-be3e171617d8

    A permanent identifier generated on first install and stored locally. It links all future events from your browser to this single device.

  • Install timestamp
    1780730075

    The Unix epoch timestamp of when you first installed the extension. Combined with the UUID, this anchors your identity to a device and date.

  • Event timestamp
    1780730178

    The time of each tracked event (install, update, version check, download).

  • Extension version
    1.0.6

    The installed version of the extension at the time of the event.

  • Operating system
    Mac

    Your computer's operating system platform (Mac, Windows, Linux, Unix).

  • Browser language
    en-US

    Your browser's UI language setting, which can narrow the geographic region or demographic profile of the device.

  • Event category
    Version

    The type of action that triggered this telemetry call (e.g. install, update, Version check, download quality selection).

The code that does this

UUID generation and telemetry dispatch in background.js

Readable version

UUID init (readable)

js/background.js
async function initUUID() {  const stored = await chrome.storage.local.get(['install_time', 'uid']);  const uid = stored.uid || uuidv4();  const installTime = stored.install_time || Math.round(Date.now() / 1000).toString();  await chrome.storage.local.set({ install_time: installTime, uid });}

Telemetry send (readable)

js/background.js
const SLS_CONFIG = {  host: 'us-west-1.log.aliyuncs.com',  project: 'hawkeye-us',  logstore: 'vimeo_tool',  // extension name used as logstore ID  time: 0.05,  count: 1  // flush immediately on every event};async function sendTelemetry(eventCategory, eventOperate, eventTag) {  const stored = await chrome.storage.local.get(['install_time', 'uid']);  const payload = {    extension_name: 'vimeo_tool',    version: chrome.runtime.getManifest().version,    uuid: stored.uid,    install_time: stored.install_time,    event_time: Math.round(Date.now() / 1000).toString(),    event_category: eventCategory || '',    event_operate: eventOperate || '',    event_tag: eventTag || '',    browser_type: isChrome ? 'chrome' : 'edge',    operate_system: getOS(),    language: chrome.i18n.getUILanguage()  };  const logger = new SLSLogger(SLS_CONFIG);  logger.send(payload);}
Telemetry destination
    • hawkeye-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud Simple Log Service (SLS), receives UUID-keyed telemetry. Project 'hawkeye-us', logstore 'vimeo_tool'. Alibaba Cloud is headquartered in China, under PRC data laws.

Where it sends data

Destinations our analysis observed Vimeo Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • hawkeye-us.us-west-1.log.aliyuncs.com

    Vimeo Downloader sends data to hawkeye-us.us-west-1.log.aliyuncs.com. 18 other extensions we have analysed send data here.

Updated 30 September 2026migiikaijhclkmlpnnfficpopgmcpgia