Is YouTube Monetization & RPM Checker by TubeLab safe?

Medium risk

YouTube Monetization & RPM Checker by TubeLab sends YouTube channel RPM and monetization details to TubeLab servers.

When tracking is enabled, the extension checks YouTube channel and Studio pages for monetization signals, channel metadata, and displayed RPM values. It sends channel IDs, page-derived channel details, RPM, and currency values to TubeLab's extension service.

antoniojmspsv1.5.4Chrome Web Store
45Risk
Who publishes it

antoniojmsps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
antoniojmsps
Website
tubelab.net/support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Default-On Channel Tracking Uploads YouTube Data to TubeLab

Opening a non-Music YouTube channel page makes TubeLab check subscriber/view counts and ad/AI signals, then send a record identifying the channel to extension.tubelab.net; tracking is on by default.

A setting can turn it off.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a YouTube channel that isn't tagged Music, for example its Videos or About tab.

The extension did this

TubeLab fetches the channel's public monetization and AI-detection signals, then sends a record identifying the channel to its own server, with no click or confirmation from you.

Runs the first time you view the channel; a local list skips channels it already reported in the last two days.

What TubeLab sends for every eligible channel you view
  • Channel ID
    UCK8sQmJBp8GCxrOtXWBpyEA

    Identifies exactly which channel you looked at.

  • Channel handle
    @Google

    The @handle of the channel you viewed.

  • Channel name
    Google

    The display name of the channel you viewed.

  • Subscriber count
    14500000

    How large the channel is, scraped from its public page.

  • Estimated total views
    6740822440

    TubeLab's own view-count estimate for the channel.

  • Video count
    2757

    Number of videos published by the channel.

  • Ad/sponsorship detection
    adsense: detected

    Whether TubeLab's heuristics flagged the channel as running ads or sponsored content.

  • AI-content flag
    madeWithAI: detected

    Whether TubeLab's heuristics flagged the channel's videos as AI-generated.

  • Timestamp
    2026-08-17T01:50:12.000Z

    When the record was generated.

Captured request
PATCHhttps://extension.tubelab.net/channel/UCK8sQmJBp8GCxrOtXWBpyEA

HTTP 202 Accepted; the extension logs "TubeLab Synched." on success.

Headers
Content-Type
application/json
Body
{  "id": "UCK8sQmJBp8GCxrOtXWBpyEA",  "time": "2026-08-17T01:50:12.000Z",  "item": {    "id": "UCK8sQmJBp8GCxrOtXWBpyEA",    "snippet": {      "handle": "@Google",      "title": "Google",      "thumbnails": [        {          "url": "https://yt3.googleusercontent.com/ytc/AIdro_...",          "width": 176,          "height": 176        }      ],      "category": "Science & Technology"    },    "statistics": {      "subscriberCount": 14500000,      "viewCountEstimate": 6740822440,      "videosCount": 2757    },    "monetization": {      "adsense": {        "status": "detected",        "detected": true,        "methods": [          "param"        ]      },      "sponsored": {        "status": "none",        "detected": false,        "methods": []      }    },    "detections": {      "madeWithAI": {        "status": "detected",        "detected": true,        "sources": [          {            "id": "video-1"          }        ]      }    }  }}
The code that does this

Tracking defaults to on, and the upload fires without asking.

Readable version

Default settings object

const SETTINGS_KEY = 'settings';const DEFAULT_SETTINGS = {  channelsEnabled: true,  videosEnabled: true,  shortsEnabled: true,  estimationsEnabled: true,  estimationsChannelEnabled: false,  allowTracking: true,   // <-- ships enabled, no onboarding opt-in step sets it  tracked: []};

The upload trigger

// Runs after scraping the channel's /videos and /about pages.if (settings?.allowTracking && category !== 'Music' && !alreadyTrackedRecently) {  try {    const detections = await runMonetizationDetectors({ videosHtml, aboutHtml, channelUrl, yppEligible });    if (detections) channelPayload.item.detections = detections;  } catch (err) {    console.warn('[tubelab] channel detections failed', err);  }  // No consent prompt, no dedicated toggle beyond the settings object above.  chrome.runtime.sendMessage({ action: 'patchChannelData', payload: channelPayload });}

The PATCH sender

const TUBELAB_API = 'https://extension.tubelab.net';async function sendChannelData(payload) {  try {    const res = await fetch(`${TUBELAB_API}/channel/${payload.id}`, {      method: 'PATCH',      headers: { 'Content-Type': 'application/json' },      body: JSON.stringify(payload)    });    if (!res.ok) {      console.error('Failed to send channel data:', res.status, res.statusText);      return;    }    console.log('TubeLab Synched.');  } catch (err) {    console.error('Failed to send channel data:', err);  }}
Where the channel record goes
    • extension.tubelab.net

    Receives a monetization/AI-detection record for every non-Music YouTube channel you view. Operated by TubeLab, the extension's own developer, listed in its manifest permissions.

Where it sends data

Destinations our analysis observed YouTube Monetization & RPM Checker by TubeLab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • extension.tubelab.net

    YouTube Monetization & RPM Checker by TubeLab sends data to extension.tubelab.net. No other extension we have analysed sends data here.

Updated 30 September 2026neagaoglchogomiemeeogamiknhkenmo