Is Vimeo™ Downloader and chatGPT Video Summary safe?

Medium risk

Vimeo Downloader collects your IP, location, OS and a persistent device ID and sends them with usage events to an Aliyun log server.

On install and as you use it, the background script reads your public IP and country (looked up via ipinfo.io / ip-api.com), operating system, browser language and a generated UUID, and forwards them with install, update, active and download events to an Alibaba Cloud log store (us-west-1.log.aliyuncs.com). On every site you visit, an all-URLs content script also fetches a developer-hosted JSON config from cdn.twiclips.com and can render its title, links and content into a promotional pop-up dialog. Its core features fetch Vimeo player config and caption tracks and, on request, paste a video transcript into chat.openai.com to generate a summary.

save.svdexv1.6.14Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

IP, UUID, and device details sent to Aliyun log store

MediumunwantedCWE-359Dynamic sandbox

On install, update, active use, or download, the worker POSTs an event (IP, region, language, OS, version, persistent UUID) to Aliyun SLS.

What actually happens

You did this

You install, update, use the extension during the day, or request a video download.

The extension did this

The background worker sends an event log with your public IP, country/region, operating system, browser language, extension version, and UUID.

Fields included in the Aliyun event record

  • Your public IP address
    2.58.72.153

    Links the event to the network address visible from your browser session.

  • Your extension UUID
    552c1abe-552d-4772-b329-0cb4c9d5fda4

    Lets separate install, activity, and download events be tied back to the same extension profile.

  • Your country or region
    GB

    Adds location context derived from the IP lookup result.

  • Your device and browser context
    Linux, chrome, en-US

    Adds the operating system, browser type, and browser language to the event record.

  • What happened in the extension
    install / user_install / 1.6.14

    Records whether the event came from install, update, activity, download, error, or a popup action.

Captured request

POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/new-simple-vimeo-download/track

Observed POST to the Aliyun log endpoint containing install-event fields and device context.

Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0

The code that does this

The event builder reads stored identity and IP context, then sends it to Aliyun SLS

Readable version

Readable event builder and Aliyun SLS target

background.js
var f, h, p = {    svd: {      name: "simple-vimeo-download",      ga: "UA-106810959-13"    },    newsvd: {      name: "new-simple-vimeo-download",      ga: "UA-106810959-29"    }  },  g = {    host: "us-west-1.log.aliyuncs.com",    project: "hawkeye-us",    logstore: p.newsvd.name,    time: .05,    count: 1  };function q(e, r, t) {  chrome.storage.local.get(["ipInfo", "uid", "install_time", "operate_system"], function(s) {    var o = {        extension_name: p.newsvd.name,        version: chrome.runtime.getManifest().version,        user_ip: s.ipInfo.ip || s.ipInfo.query || "",        uuid: s.uid,        install_time: s.install_time,        event_time: Math.round((new Date).getTime() / 1e3).toString(),        event_category: e || "",        event_operate: r || "",        event_tag: t || "",        browser_type: "chrome",        operate_system: s.operate_system,        region: s.ipInfo.country || "",        language: navigator.language      },      i = new n.default(g);    console.log(o), i.send(o)  })}

Readable install/update IP lookup and activity trigger

background.js
function b() {  return (b = m(l().mark(function e(r) {    var n, i, a, u, c, d;    return l().wrap(function(e) {      for (;;) switch (e.prev = e.next) {        case 0:          return n = o.default.runtime.getManifest(), e.next = 3, chrome.storage.local.get({            uid: (0, s.v4)()          });        case 3:          return i = e.sent, chrome.storage.local.set({            uid: i.uid,            version: n.version          }), console.log(i), h = new t.default(p.newsvd.ga, f), console.log("initga"), e.next = 10, o.default.storage.local.get(["operate_system", "install_time"]);        case 10:          return a = e.sent, console.log(a), u = a.operate_system || y(), c = a.install_time || Math.round((new Date).getTime() / 1e3).toString(), {            extension: "vimeo",            url: "https://chrome.google.com/webstore/detail/simple-vimeo-downloader/mffmjlddchdccijipncbjhoabgmphjfb",            uuid: i.uid,            browser: "chrome",            version: n.version,            install_time: c          }, console.log(c), e.prev = 16, e.next = 19, fetch("https://ipinfo.io/json").then(function(e) {            return e.json()          });        case 19:          d = e.sent, e.next = 27;          break;        case 22:          return e.prev = 22, e.t0 = e.catch(16), e.next = 26, fetch("http://ip-api.com/json/").then(function(e) {            return e.json()          });        case 26:          d = e.sent;        case 27:          chrome.storage.local.set({            install_time: c,            operate_system: u,            VimeoExt: i,            ipInfo: d          }), "install" == r.reason ? q("install", "user_install", n.version) : q("update", "user_update", n.version);        case 29:        case "end":          return e.stop()      }    }, e, null, [      [16, 22]    ])  }))).apply(this, arguments)}function _() {  chrome.storage.local.get(["active_time"], function(e) {    "undefined" !== e.active_time && new Date(1e3 * Number(e.active_time)).toDateString() === (new Date).toDateString() || (q("active", "user_active", "download"), chrome.storage.local.set({      active_time: Math.round((new Date).getTime() / 1e3).toString()    }))  })}

The code that does this

The bundled logger turns queued event objects into an Aliyun POST

Readable version

Readable SLS logger request construction

background.js
key: "logger",value: async function(t = !1) {  var e = !1 !== t && t.length > 0 ? t : [];  if (0 !== e.length) {    var o = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";    try {      var r = JSON.stringify({        __logs__: e      });      let t = new Headers({        "x-log-apiversion": "0.6.0",        "x-log-bodyrawsize": r.length      });      if (this.compress) {        t.append("x-log-compresstype", "lz4");        var n = s.from(r),          a = i.encodeBound(r.length),          l = s.alloc(a),          c = i.encodeBlock(n, l);        l = l.slice(0, c), fetch(o, {          method: "POST",          headers: t,          body: l        }).then(t => t)      } else {        let e = new Blob([r], {          type: "application/x-protobuf"        });        t.append("Content-Type", "application/x-protobuf"), fetch(o, {          method: "POST",          headers: t,          body: e        }).then(t => t)      }    } catch (h) {      console.log(h)    }  }}

Remote services contacted for this event path

    • ipinfo.io

    Primary public-IP metadata lookup during install or update.

    • ip-api.com

    Fallback public-IP metadata lookup if the first lookup fails.

    • hawkeye-us.us-west-1.log.aliyuncs.com

    Aliyun SLS log store that receives the extension event record.

What it can do

Permissions this extension asks for, as declared in version 1.6.14. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on vimeo.com

    *://vimeo.com/*

  • Read and change your data on player.vimeo.com

    *://player.vimeo.com/*

  • Read and change your data on vimeocdn.com

    *://*.vimeocdn.com/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Vimeo™ Downloader and chatGPT Video Summary contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ip-api.comwidely used

    Vimeo™ Downloader and chatGPT Video Summary sends data to ip-api.com. A widely used service: 73 other extensions we have analyzed send data here.

  • ipinfo.iowidely used

    Vimeo™ Downloader and chatGPT Video Summary sends data to ipinfo.io. A widely used service: 53 other extensions we have analyzed send data here.

  • chat.openai.comwidely used

    Vimeo™ Downloader and chatGPT Video Summary sends data to chat.openai.com. A widely used service: 35 other extensions we have analyzed send data here.

  • us-west-1.log.aliyuncs.com

    Vimeo™ Downloader and chatGPT Video Summary sends data to us-west-1.log.aliyuncs.com. 12 other extensions we have analyzed send data here.

  • cdn.twiclips.com

    Vimeo™ Downloader and chatGPT Video Summary sends data to cdn.twiclips.com. One other extension we have analyzed sends data here.

Updated 30 September 2026hobdeidpfblapjhejaaigpicnlijdopo