Is Vimeo™ Downloader and chatGPT Video Summary safe?

Medium risk

Vimeo Downloader collects your IP, location, OS and a persistent device ID and sends them with usage events to an Aliyun log server.

On install and as you use it, the background script reads your public IP and country (looked up via ipinfo.io / ip-api.com), operating system, browser language and a generated UUID, and forwards them with install, update, active and download events to an Alibaba Cloud log store (us-west-1.log.aliyuncs.com). On every site you visit, an all-URLs content script also fetches a developer-hosted JSON config from cdn.twiclips.com and can render its title, links and content into a promotional pop-up dialog. Its core features fetch Vimeo player config and caption tracks and, on request, paste a video transcript into chat.openai.com to generate a summary.

save.svdexv1.6.14Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

IP, UUID, and device details sent to Aliyun log store

On install, update, active use, or download, the worker POSTs an event (IP, region, language, OS, version, persistent UUID) to Aliyun SLS.

A capture had IP 2.58.72.153, UUID 552c1abe-552d-4772-b329-0cb4c9d5fda4, chrome, Linux, GB, en-US.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install, update, use the extension during the day, or request a video download.

The extension did this

The background worker sends an event log with your public IP, country/region, operating system, browser language, extension version, and UUID.

02EvidenceFIELD TABLE
Fields included in the Aliyun event record
FieldValueWhy it matters
Your public IP address
2.58.72.153Links the event to the network address visible from your browser session.
Your extension UUID
552c1abe-552d-4772-b329-0cb4c9d5fda4Lets separate install, activity, and download events be tied back to the same extension profile.
Your country or region
GBAdds location context derived from the IP lookup result.
Your device and browser context
Linux, chrome, en-USAdds the operating system, browser type, and browser language to the event record.
What happened in the extension
install / user_install / 1.6.14Records whether the event came from install, update, activity, download, error, or a popup action.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/new-simple-vimeo-download/track
Observed POST to the Aliyun log endpoint containing install-event fields and device context.
Headers
Content-Typeapplication/x-protobuf
x-log-apiversion0.6.0
04EvidenceCODE COMPARE
The code that does this

The event builder reads stored identity and IP context, then sends it to Aliyun SLS

What it actually does
Readable event builder and Aliyun SLS targetbackground.js
var f, h, p = {
    svd: {
      name: "simple-vimeo-download",
      ga: "UA-106810959-13"
    },
    newsvd: {
      name: "new-simple-vimeo-download",
      ga: "UA-106810959-29"
    }
  },
  g = {
    host: "us-west-1.log.aliyuncs.com",
    project: "hawkeye-us",
    logstore: p.newsvd.name,
    time: .05,
    count: 1
  };

function q(e, r, t) {
  chrome.storage.local.get(["ipInfo", "uid", "install_time", "operate_system"], function(s) {
    var o = {
        extension_name: p.newsvd.name,
        version: chrome.runtime.getManifest().version,
        user_ip: s.ipInfo.ip || s.ipInfo.query || "",
        uuid: s.uid,
        install_time: s.install_time,
        event_time: Math.round((new Date).getTime() / 1e3).toString(),
        event_category: e || "",
        event_operate: r || "",
        event_tag: t || "",
        browser_type: "chrome",
        operate_system: s.operate_system,
        region: s.ipInfo.country || "",
        language: navigator.language
      },
      i = new n.default(g);
    console.log(o), i.send(o)
  })
}
Readable install/update IP lookup and activity triggerbackground.js
function b() {
  return (b = m(l().mark(function e(r) {
    var n, i, a, u, c, d;
    return l().wrap(function(e) {
      for (;;) switch (e.prev = e.next) {
        case 0:
          return n = o.default.runtime.getManifest(), e.next = 3, chrome.storage.local.get({
            uid: (0, s.v4)()
          });
        case 3:
          return i = e.sent, chrome.storage.local.set({
            uid: i.uid,
            version: n.version
          }), console.log(i), h = new t.default(p.newsvd.ga, f), console.log("initga"), e.next = 10, o.default.storage.local.get(["operate_system", "install_time"]);
        case 10:
          return a = e.sent, console.log(a), u = a.operate_system || y(), c = a.install_time || Math.round((new Date).getTime() / 1e3).toString(), {
            extension: "vimeo",
            url: "https://chrome.google.com/webstore/detail/simple-vimeo-downloader/mffmjlddchdccijipncbjhoabgmphjfb",
            uuid: i.uid,
            browser: "chrome",
            version: n.version,
            install_time: c
          }, console.log(c), e.prev = 16, e.next = 19, fetch("https://ipinfo.io/json").then(function(e) {
            return e.json()
          });
        case 19:
          d = e.sent, e.next = 27;
          break;
        case 22:
          return e.prev = 22, e.t0 = e.catch(16), e.next = 26, fetch("http://ip-api.com/json/").then(function(e) {
            return e.json()
          });
        case 26:
          d = e.sent;
        case 27:
          chrome.storage.local.set({
            install_time: c,
            operate_system: u,
            VimeoExt: i,
            ipInfo: d
          }), "install" == r.reason ? q("install", "user_install", n.version) : q("update", "user_update", n.version);
        case 29:
        case "end":
          return e.stop()
      }
    }, e, null, [
      [16, 22]
    ])
  }))).apply(this, arguments)
}

function _() {
  chrome.storage.local.get(["active_time"], function(e) {
    "undefined" !== e.active_time && new Date(1e3 * Number(e.active_time)).toDateString() === (new Date).toDateString() || (q("active", "user_active", "download"), chrome.storage.local.set({
      active_time: Math.round((new Date).getTime() / 1e3).toString()
    }))
  })
}
05EvidenceCODE COMPARE
The code that does this

The bundled logger turns queued event objects into an Aliyun POST

What it actually does
Readable SLS logger request constructionbackground.js
key: "logger",
value: async function(t = !1) {
  var e = !1 !== t && t.length > 0 ? t : [];
  if (0 !== e.length) {
    var o = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";
    try {
      var r = JSON.stringify({
        __logs__: e
      });
      let t = new Headers({
        "x-log-apiversion": "0.6.0",
        "x-log-bodyrawsize": r.length
      });
      if (this.compress) {
        t.append("x-log-compresstype", "lz4");
        var n = s.from(r),
          a = i.encodeBound(r.length),
          l = s.alloc(a),
          c = i.encodeBlock(n, l);
        l = l.slice(0, c), fetch(o, {
          method: "POST",
          headers: t,
          body: l
        }).then(t => t)
      } else {
        let e = new Blob([r], {
          type: "application/x-protobuf"
        });
        t.append("Content-Type", "application/x-protobuf"), fetch(o, {
          method: "POST",
          headers: t,
          body: e
        }).then(t => t)
      }
    } catch (h) {
      console.log(h)
    }
  }
}
06EvidenceTHIRD PARTY LIST
Remote services contacted for this event path
  • ipinfo.io

    Primary public-IP metadata lookup during install or update.

  • ip-api.com

    Fallback public-IP metadata lookup if the first lookup fails.

  • hawkeye-us.us-west-1.log.aliyuncs.com

    Aliyun SLS log store that receives the extension event record.

Data recipients

us-west-1.log.aliyuncs.comcdn.twiclips.comipinfo.ioip-api.comchat.openai.com
Updated 17 September 2026hobdeidpfblapjhejaaigpicnlijdopo