Security Warning: High Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: 智能bilibili下载助手工具

HIGH RISK

智能bilibili下载助手工具

ID: plbcgcmgflcglefglepkdodjodongkip

Supported Languages

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

Extension Info & Metadata

Status

Active

Version

1.0.0

Size

0.16 MB

Rating

5.0/5

Reviews

Users

10,000

Type

Extension

Updated

May 23, 2024

Publisher Contextual Analysis

Author: 智能bilibili下载助手工具View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

智能bilibili下载助手工具

为Bilibili用户量身打造的智能Bilibili下载助手工具！🚀 功能亮点：轻松从Bilibili下载视频 🎬 高速高效，让您迅速保存心仪的视频内容 💾 直观界面，操作简便，一键下载 🖱️ 只需轻轻一点，即可将Bilibili上的精彩视频保存到您的设备中，随时随地尽情观看！✨📲

User Growth

Showing data from May 23, 2024 to May 22, 2025

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 15 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High2

Medium4

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0 Code review	7

Extension Version	Code Review Findings
1.0.0	7

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js6
js/content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	high	js/background.js (line 57)	The extension is advertised as a bilibili downloader and its declared content_scripts are restricted to *.bilibili.com, yet the service worker programmatically uses chrome.scripting.executeScript to inject inject.js a…	1.0.0
2	Unauthorized Data Collection	high	js/background.js (line 77)	The injected scripts run on every non-bilibili tab the user visits, with allFrames:true for bili-player-inject.js. They have full DOM access on arbitrary websites (banking, webmail, internal corporate apps, etc.) and …	1.0.0
3	Credential Theft	medium	js/background.js (line 97)	The background worker exposes the user's bilibili SESSDATA authentication cookie to any caller of chrome.runtime.sendMessage({action:'getCookie'}). Because the extension's runtime is reachable from its content scripts…	1.0.0
4	Credential Theft	medium	js/content.js (line 192)	The content script manually attaches the SESSDATA cookie (obtained from the background worker via chrome.cookies.get) into a fetch() request as an explicit `cookie` header, in addition to credentials:'include'. This p…	1.0.0
5	Tracking	medium	js/background.js (line 140)	The extension generates a persistent UUID v4 client_id (stored in chrome.storage.local) and fires events to Google Analytics Measurement Protocol with hard-coded measurement_id 'G-K9VHYQ9F5N' and api_secret 'tNtHyUZwS…	1.0.0
6	Tracking	medium	js/background.js (line 207)	A chrome.alarms listener is registered to fire a 'run' analytics beacon to Google Analytics every 60 minutes for the lifetime of the install, independent of any user action. This converts the extension into a long-run…	1.0.0
7	Obfuscation	low	js/background.js (line 1)	Every shipped JavaScript bundle (background.js, content.js, inject.js, interceptor.js, bili-player-inject.js, popup.js) is minified with all identifiers renamed to a confusable two-letter alphabet (eb, ix, eS, FM, sC,…	1.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.bilibili.com	-	https://www.bilibili.com
www.google-analytics.com	/mp/collect	https://www.google-analytics.com/mp/collect
www.google-analytics.com	/debug/mp/collect	https://www.google-analytics.com/debug/mp/collect
github.com	/uuidjs/uuid	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
api.bilibili.com	/pgc/player/web/playurl	https://api.bilibili.com/pgc/player/web/playurl
api.bilibili.com	/x/player/playurl	https://api.bilibili.com/x/player/playurl
player.bilibili.com	-	https://player.bilibili.com
www.bilibili.com	-	https://www.bilibili.com/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I couldn't have done it without it

Brandon Neely·13 Sept 2024

Made my job so much easier

Jhordy Holub·13 Sept 2024

Very convenient and useful extension

Vilmer Arias·13 Sept 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Warning: High Security Risk

智能bilibili下载助手工具

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating