Is Vimeo™ Downloader and chatGPT Video Summary safe?
Vimeo Downloader collects your IP, location, OS and a persistent device ID and sends them with usage events to an Aliyun log server.
On install and as you use it, the background script reads your public IP and country (looked up via ipinfo.io / ip-api.com), operating system, browser language and a generated UUID, and forwards them with install, update, active and download events to an Alibaba Cloud log store (us-west-1.log.aliyuncs.com). On every site you visit, an all-URLs content script also fetches a developer-hosted JSON config from cdn.twiclips.com and can render its title, links and content into a promotional pop-up dialog. Its core features fetch Vimeo player config and caption tracks and, on request, paste a video transcript into chat.openai.com to generate a summary.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
IP, UUID, and device details sent to Aliyun log store
On install, update, active use, or download, the worker POSTs an event (IP, region, language, OS, version, persistent UUID) to Aliyun SLS.
A capture had IP 2.58.72.153, UUID 552c1abe-552d-4772-b329-0cb4c9d5fda4, chrome, Linux, GB, en-US.
What actually happens
You install, update, use the extension during the day, or request a video download.
The background worker sends an event log with your public IP, country/region, operating system, browser language, extension version, and UUID.
Fields included in the Aliyun event record
- Your public IP address2.58.72.153
Links the event to the network address visible from your browser session.
- Your extension UUID552c1abe-552d-4772-b329-0cb4c9d5fda4
Lets separate install, activity, and download events be tied back to the same extension profile.
- Your country or regionGB
Adds location context derived from the IP lookup result.
- Your device and browser contextLinux, chrome, en-US
Adds the operating system, browser type, and browser language to the event record.
- What happened in the extensioninstall / user_install / 1.6.14
Records whether the event came from install, update, activity, download, error, or a popup action.
Captured request
Observed POST to the Aliyun log endpoint containing install-event fields and device context.
- Content-Type
- application/x-protobuf
- x-log-apiversion
- 0.6.0
The code that does this
The event builder reads stored identity and IP context, then sends it to Aliyun SLS
Readable event builder and Aliyun SLS target
background.jsvar f, h, p = { svd: { name: "simple-vimeo-download", ga: "UA-106810959-13" }, newsvd: { name: "new-simple-vimeo-download", ga: "UA-106810959-29" } }, g = { host: "us-west-1.log.aliyuncs.com", project: "hawkeye-us", logstore: p.newsvd.name, time: .05, count: 1 };function q(e, r, t) { chrome.storage.local.get(["ipInfo", "uid", "install_time", "operate_system"], function(s) { var o = { extension_name: p.newsvd.name, version: chrome.runtime.getManifest().version, user_ip: s.ipInfo.ip || s.ipInfo.query || "", uuid: s.uid, install_time: s.install_time, event_time: Math.round((new Date).getTime() / 1e3).toString(), event_category: e || "", event_operate: r || "", event_tag: t || "", browser_type: "chrome", operate_system: s.operate_system, region: s.ipInfo.country || "", language: navigator.language }, i = new n.default(g); console.log(o), i.send(o) })}Readable install/update IP lookup and activity trigger
background.jsfunction b() { return (b = m(l().mark(function e(r) { var n, i, a, u, c, d; return l().wrap(function(e) { for (;;) switch (e.prev = e.next) { case 0: return n = o.default.runtime.getManifest(), e.next = 3, chrome.storage.local.get({ uid: (0, s.v4)() }); case 3: return i = e.sent, chrome.storage.local.set({ uid: i.uid, version: n.version }), console.log(i), h = new t.default(p.newsvd.ga, f), console.log("initga"), e.next = 10, o.default.storage.local.get(["operate_system", "install_time"]); case 10: return a = e.sent, console.log(a), u = a.operate_system || y(), c = a.install_time || Math.round((new Date).getTime() / 1e3).toString(), { extension: "vimeo", url: "https://chrome.google.com/webstore/detail/simple-vimeo-downloader/mffmjlddchdccijipncbjhoabgmphjfb", uuid: i.uid, browser: "chrome", version: n.version, install_time: c }, console.log(c), e.prev = 16, e.next = 19, fetch("https://ipinfo.io/json").then(function(e) { return e.json() }); case 19: d = e.sent, e.next = 27; break; case 22: return e.prev = 22, e.t0 = e.catch(16), e.next = 26, fetch("http://ip-api.com/json/").then(function(e) { return e.json() }); case 26: d = e.sent; case 27: chrome.storage.local.set({ install_time: c, operate_system: u, VimeoExt: i, ipInfo: d }), "install" == r.reason ? q("install", "user_install", n.version) : q("update", "user_update", n.version); case 29: case "end": return e.stop() } }, e, null, [ [16, 22] ]) }))).apply(this, arguments)}function _() { chrome.storage.local.get(["active_time"], function(e) { "undefined" !== e.active_time && new Date(1e3 * Number(e.active_time)).toDateString() === (new Date).toDateString() || (q("active", "user_active", "download"), chrome.storage.local.set({ active_time: Math.round((new Date).getTime() / 1e3).toString() })) })}The code that does this
The bundled logger turns queued event objects into an Aliyun POST
Readable SLS logger request construction
background.jskey: "logger",value: async function(t = !1) { var e = !1 !== t && t.length > 0 ? t : []; if (0 !== e.length) { var o = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track"; try { var r = JSON.stringify({ __logs__: e }); let t = new Headers({ "x-log-apiversion": "0.6.0", "x-log-bodyrawsize": r.length }); if (this.compress) { t.append("x-log-compresstype", "lz4"); var n = s.from(r), a = i.encodeBound(r.length), l = s.alloc(a), c = i.encodeBlock(n, l); l = l.slice(0, c), fetch(o, { method: "POST", headers: t, body: l }).then(t => t) } else { let e = new Blob([r], { type: "application/x-protobuf" }); t.append("Content-Type", "application/x-protobuf"), fetch(o, { method: "POST", headers: t, body: e }).then(t => t) } } catch (h) { console.log(h) } }}Remote services contacted for this event path
- ipinfo.io
Primary public-IP metadata lookup during install or update.
- ip-api.com
Fallback public-IP metadata lookup if the first lookup fails.
- hawkeye-us.us-west-1.log.aliyuncs.com
Aliyun SLS log store that receives the extension event record.
What it can do
Permissions this extension asks for, as declared in version 1.6.14. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on vimeo.com
*://vimeo.com/*
Read and change your data on player.vimeo.com
*://player.vimeo.com/*
Read and change your data on vimeocdn.com
*://*.vimeocdn.com/*
Act on the current tab, but only after you click the extension
activeTab
Start, monitor and manage your downloads
downloads
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Vimeo™ Downloader and chatGPT Video Summary contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
Vimeo™ Downloader and chatGPT Video Summary sends data to ip-api.com. A widely used service: 73 other extensions we have analyzed send data here.
- ipinfo.iowidely used
Vimeo™ Downloader and chatGPT Video Summary sends data to ipinfo.io. A widely used service: 53 other extensions we have analyzed send data here.
- chat.openai.comwidely used
Vimeo™ Downloader and chatGPT Video Summary sends data to chat.openai.com. A widely used service: 35 other extensions we have analyzed send data here.
- us-west-1.log.aliyuncs.com
Vimeo™ Downloader and chatGPT Video Summary sends data to us-west-1.log.aliyuncs.com. 12 other extensions we have analyzed send data here.
- cdn.twiclips.com
Vimeo™ Downloader and chatGPT Video Summary sends data to cdn.twiclips.com. One other extension we have analyzed sends data here.
