Is YouTube Mini Player safe?
YouTube Mini Player generates a persistent device fingerprint and sends it with every request to the developer's server.
On each YouTube page load, the extension uses bundled FingerprintJS v4.5.1 to generate a stable device identifier (visitorId), which it stores locally and appends as a tracking parameter to all API calls. Every page visit triggers a config fetch to antonkhoteev.com that transmits this fingerprint ID alongside an install-time UUID and the extension version. User interactions such as enabling picture-in-picture mode, viewing the paywall, and submitting ratings also fire GET requests to the same server with the persistent identifier attached.
Who publishes itAnton Khoteev - 2 other listings from the same operator, 2 of them carrying a finding
Anton Khoteev - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 60k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
FingerprintJS Generates Persistent Device ID Sent to Developer Server
DA captured a GET to antonkhoteev.com/khoteev-api/pipy/config carrying a FingerprintJS-derived userId, right after loading YouTube.
FingerprintJS hashes canvas/WebGL/audio/font signals into this ID, letting the server correlate sessions.
What actually happens
You open any YouTube page with the extension installed.
No interaction is required; the fingerprinting code runs automatically on page mount.
The extension runs FingerprintJS v4.5.1, generates a stable 32-character device fingerprint, stores it, and sends it to the developer's server.
The hash is calculated once and cached in chrome.storage.local; on subsequent visits the stored value is reused without re-fingerprinting.
The code that does this
generateUserId, FingerprintJS integration
const generateUserId = async => { try { const fp = await load; const result = await fp.get; if (result.visitorId) { return result.visitorId; } } catch (e) {} return null;};Data collected by FingerprintJS and stored as userId
- Device fingerprint IDc3c46173b52097fd436012c4d25414fc
A 32-character hex hash of your browser and hardware traits. It stays the same across visits, letting the server link your YouTube sessions.
- Canvas rendering signatureAq6+ACgAAAAA... (base64 canvas snapshot)
How your GPU renders specific shapes; contributes to the fingerprint. Differs between devices and graphics drivers.
- WebGL renderer stringANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0)
Your GPU model and driver version, as reported by WebGL; a high-entropy fingerprint signal.
- Audio context fingerprint124.04347527516074
A numeric hash of how your browser processes audio; stable per device.
Captured request
Where the fingerprint ID is transmitted
- antonkhoteev.com
Developer's own API server. Receives userId (FingerprintJS hash), userUuid, and extension version on every YouTube page load. Declared in manifest host_permissions.
- m1.openfpcdn.io
FingerprintJS npm monitoring endpoint. Receives a GET request approximately 0.1% of the time (Math.random < 1e-3) to report library usage. Operated by Fingerprint Inc.
Config Fetch Transmits Device Fingerprint and Install UUID on Every YouTube Page
DA captured a GET to antonkhoteev.com/khoteev-api/pipy/config carrying userId (FingerprintJS hash), userUuid (install UUID), and version on every YouTube load, before interaction.
Both persist across restarts, tracking your visits.
What actually happens
You load any YouTube page with the extension installed.
The config fetch fires automatically on every page mount with no user interaction required.
The extension immediately sends your device fingerprint ID, install UUID, and extension version to the developer's server as a GET request.
The server returns configuration data (paywall limits, rating prompts) which the extension applies locally.
Captured request
The code that does this
initConfig, identifiers appended to config URL
const initConfig = async => { var _a, _b; try { const getConfigUrl = new URL("https://antonkhoteev.com/khoteev-api/pipy/config"); if (userStore.userId) getConfigUrl.searchParams.append("userId", userStore.userId); if (userStore.userUuid) getConfigUrl.searchParams.append("userUuid", userStore.userUuid); if ((_b = (_a = chrome.runtime)?.getManifest)?.version) getConfigUrl.searchParams.append("version", chrome.runtime.getManifest.version); const response = await fetch(getConfigUrl, { method: "GET" }); const config = await response.json; // config.paywall, config.rating, config.activeSubscription applied } catch (e) { console.log(e); }};Query parameters sent to antonkhoteev.com on every YouTube page load
- Device fingerprint ID (userId)c3c46173b52097fd436012c4d25414fc
A 32-character hex hash of browser/hardware traits from FingerprintJS v4.5.1. Stable across restarts; identifies your device persistently.
- Install UUID (userUuid)7ef96777-8f6c-4087-a691-7e6d26131a3c
A UUID assigned when the extension is first installed. Unique per installation and persists in chrome.storage.local.
- Extension version3.1.0
The installed extension version number, allowing the server to track the extension version in use per user.
Destination of the config request
- antonkhoteev.com
Developer's own API server. Receives userId, userUuid, and version on every YouTube page load, plus paywall-view and rating events. Declared in host_permissions.
What it can do
Permissions this extension asks for, as declared in version 3.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 4.1.8, which we have not unpacked yet.
Read and change your data on antonkhoteev.com
https://antonkhoteev.com/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed YouTube Mini Player contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- antonkhoteev.com
YouTube Mini Player sends data to antonkhoteev.com. 2 other extensions we have analyzed send data here.