[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

DataTool-Video Downloader

Version 2.5.0 View in Chrome Web Store

Last scanned: about 6 hours ago

Extension Details

Developer: https://www.datatool.vip/

Rating: 4.6 ★ (74 ratings)

Users: 40,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has a moderate user base of 40,000 users and a decent rating of 4.6 stars from 74 reviews, which provides some community validation. However, the developer website (datatool.vip) appears to be a commercial service, and the extension's broad scope across multiple major platforms raises concerns about the true intent behind data collection.

Concerns:

The extension requests extremely broad permissions that far exceed what's necessary for a typical video downloader. The cookies permission combined with access to major social media platforms, AI chat services, and financial platforms creates significant privacy risks. The tabs permission allows monitoring of browsing activity across all accessed sites. Most concerning is the content script injection across virtually all websites (https://*/*), enabling the extension to monitor and potentially extract data from any site you visit. The combination of unlimited storage and broad host permissions suggests potential for extensive data harvesting beyond video downloading functionality.

Recommendations:

Given the critical risk level, avoid installing this extension on your main browser profile. If you must use it, create a dedicated Chrome profile with minimal personal data and only use it for video downloading tasks. Consider alternative video downloaders with more limited permissions. Monitor your accounts for unusual activity if you've already used this extension. The broad permissions suggest this tool may be collecting far more data than necessary for its stated purpose.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://www.instagram.com/*, https://gemini.google.com/*, https://twitter.com/*, https://www.facebook.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
scripting
tabs
activetab
downloads
downloads.open
unlimitedStorage
browser
cookies
declarativeNetRequest

Host Permissions:

https://www.instagram.com/*
https://www.tiktok.com/*
https://ads.tiktok.com/*
https://chatgpt.com/*
https://chat.openai.com/*
https://www.doubao.com/*
https://kimi.moonshot.cn/*
https://www.kimi.com/*
https://chat.deepseek.com/*
https://claude.ai/*
https://chat.x.ai/*
https://grok.com/*
https://gemini.google.com/*
https://x.com/*
https://twitter.com/*
https://api.datatool.vip/*
https://www.datatool.vip/*
https://www.douyin.com/*
https://www.xiaohongshu.com/*
https://creatormarketplace.tiktok.com/*
https://www.youtube.com/*
https://www.facebook.com/*
https://www.bilibili.com/*
https://space.bilibili.com/*
https://search.bilibili.com/*
https://www.kwai.com/*
https://www.kuaishou.com/*
https://vimeo.com/*
https://www.xinpianchang.com/*
https://mod-api.xinpianchang.com/*

Embedded URLs (216 total):

http://www.w3.org/1999/xlink	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	https://vuejs.org/error-reference/#runtime-
https://chatgpt.com/	https://chat.openai.com/
https://www.doubao.com/	https://chat.deepseek.com/
https://www.kimi.com/	https://kimi.moonshot.cn/
https://claude.ai/	https://chat.x.ai/
https://grok.com/	https://gemini.google.com/
https://www.datatool.vip	https://www.datatool.vip/frontend/user/action-log/add
https://www.bilibili.com/	https://space.bilibili.com/
https://search.bilibili.com/	https://www.bilibili.com/video/
https://www.bilibili.com/match/	https://search.bilibili.com/all
https://www.datatool.vip/pricing?from=extension	http://temp.com
http://sheetjs.com	http://schemas.openxmlformats.org/package/2006/metadata/core-properties
http://schemas.openxmlformats.org/officeDocument/2006/custom-properties	http://schemas.openxmlformats.org/officeDocument/2006/extended-properties
http://schemas.openxmlformats.org/package/2006/content-types	http://schemas.openxmlformats.org/package/2006/relationships
http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments	http://purl.org/dc/elements/1.1/
http://purl.org/dc/terms/	http://purl.org/dc/dcmitype/
http://schemas.openxmlformats.org/officeDocument/2006/relationships	http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes
http://www.w3.org/2001/XMLSchema-instance	http://www.w3.org/2001/XMLSchema
http://schemas.openxmlformats.org/spreadsheetml/2006/main	http://purl.oclc.org/ooxml/spreadsheetml/main
http://schemas.microsoft.com/office/excel/2006/main	http://schemas.microsoft.com/office/excel/2006/2
http://www.w3.org/TR/REC-html40	http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument
http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink	http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing
http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath	http://schemas.microsoft.com/office/2006/relationships/xlExternalLinkPath/xlPathMissing
http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments	http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties
http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties	http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties
http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings	http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles
http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme	http://schemas.openxmlformats.org/officeDocument/2006/relationships/chartsheet
http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet	http://purl.oclc.org/ooxml/officeDocument/relationships/worksheet
http://schemas.openxmlformats.org/officeDocument/2006/relationships/dialogsheet	http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet
http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing	http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata
http://schemas.microsoft.com/office/2017/10/relationships/threadedComment	http://schemas.microsoft.com/office/2017/10/relationships/person
http://schemas.microsoft.com/office/2006/relationships/vbaProject	http://docs.oasis-open.org/ns/office/1.2/meta/
http://schemas.openxmlformats.org/drawingml/2006/main	http://schemas.microsoft.com/office/spreadsheetml/2017/richdata
http://schemas.microsoft.com/office/spreadsheetml/2017/dynamicarray	http://openoffice.org/2004/office
http://openoffice.org/2004/writer	http://openoffice.org/2004/calc
http://www.w3.org/2001/xml-events	http://www.w3.org/2002/xforms
http://openoffice.org/2005/report	http://www.w3.org/1999/xhtml
http://www.w3.org/2003/g/data-view#	http://openoffice.org/2009/table
http://openoffice.org/2010/draw	http://www.w3.org/TR/css3-text/

Page 1 of 3

Raw Manifest

{
  "name": "__MSG_displayName__",
  "icons": {
    "16": "icon16.plasmo.6c567d50.png",
    "32": "icon32.plasmo.76b92899.png",
    "48": "icon48.plasmo.aced7582.png",
    "64": "icon64.plasmo.8bb5e6e0.png",
    "128": "icon128.plasmo.3c1ed2d2.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.plasmo.6c567d50.png",
      "32": "icon32.plasmo.76b92899.png",
      "48": "icon48.plasmo.aced7582.png",
      "64": "icon64.plasmo.8bb5e6e0.png",
      "128": "icon128.plasmo.3c1ed2d2.png"
    },
    "default_popup": "popup.html"
  },
  "author": "datatoolvip@gmail.com",
  "version": "2.5.0",
  "background": {
    "service_worker": "static/background/index.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "storage",
    "scripting",
    "tabs",
    "activetab",
    "downloads",
    "downloads.open",
    "unlimitedStorage",
    "browser",
    "cookies",
    "declarativeNetRequest"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "datatoolBackgroundTrans.926adca8.js"
      ],
      "css": [],
      "matches": [
        "https://instagram.com/*",
        "https://x.com/*",
        "https://*/*",
        "https://www.xiaohongshu.com/*",
        "https://www.tiktok.com/*",
        "https://www.snapchat.com/*",
        "https://web.snapchat.com/*",
        "https://www.kuaishou.com/*",
        "https://ads.tiktok.com/*",
        "https://creatormarketplace.tiktok.com/*",
        "https://www.facebook.com/*",
        "https://www.bilibili.com/*",
        "https://space.bilibili.com/*",
        "https://search.bilibili.com/*",
        "https://chatgpt.com/*",
        "https://chat.openai.com/*",
        "https://www.doubao.com/*",
        "https://chat.deepseek.com/*",
        "https://www.kimi.com/*",
        "https://kimi.moonshot.cn/*",
        "https://claude.ai/*",
        "https://chat.x.ai/*",
        "https://grok.com/*",
        "https://gemini.google.com/*",
        "https://www.kwai.com/*",
        "https://vimeo.com/*",
        "https://www.xinpianchang.com/*"
      ]
    },
    {
      "js": [
        "contents.e02f0287.js"
      ],
      "css": [
        "contents.4be03896.css",
        "contents.4dd1ecda.css"
      ],
      "run_at": "document_start",
      "matches": [
        "https://www.tiktok.com/*",
        "https://ads.tiktok.com/*",
        "https://www.instagram.com/*",
        "https://x.com/*",
        "https://www.xiaohongshu.com/*",
        "https://www.douyin.com/*",
        "https://creatormarketplace.tiktok.com/*",
        "https://www.datatool.vip/*",
        "https://www.youtube.com/*",
        "https://www.facebook.com/*",
        "https://www.bilibili.com/*",
        "https://space.bilibili.com/*",
        "https://search.bilibili.com/*",
        "https://chatgpt.com/*",
        "https://chat.openai.com/*",
        "https://www.doubao.com/*",
        "https://chat.deepseek.com/*",
        "https://www.kimi.com/*",
        "https://kimi.moonshot.cn/*",
        "https://claude.ai/*",
        "https://chat.x.ai/*",
        "https://grok.com/*",
        "https://gemini.google.com/*",
        "https://www.kwai.com/*",
        "https://www.kuaishou.com/*",
        "http://test.fmpets.cn:8106/*",
        "https://vimeo.com/*",
        "https://www.xinpianchang.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://www.instagram.com/*",
    "https://www.tiktok.com/*",
    "https://ads.tiktok.com/*",
    "https://chatgpt.com/*",
    "https://chat.openai.com/*",
    "https://www.doubao.com/*",
    "https://kimi.moonshot.cn/*",
    "https://www.kimi.com/*",
    "https://chat.deepseek.com/*",
    "https://claude.ai/*",
    "https://chat.x.ai/*",
    "https://grok.com/*",
    "https://gemini.google.com/*",
    "https://x.com/*",
    "https://twitter.com/*",
    "https://api.datatool.vip/*",
    "https://www.datatool.vip/*",
    "https://www.douyin.com/*",
    "https://www.xiaohongshu.com/*",
    "https://creatormarketplace.tiktok.com/*",
    "https://www.youtube.com/*",
    "https://www.facebook.com/*",
    "https://www.bilibili.com/*",
    "https://space.bilibili.com/*",
    "https://search.bilibili.com/*",
    "https://www.kwai.com/*",
    "https://www.kuaishou.com/*",
    "https://vimeo.com/*",
    "https://www.xinpianchang.com/*",
    "https://mod-api.xinpianchang.com/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://www.datatool.vip/*"
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "assets/js/*.js",
        "assets/image/*.png"
      ]
    },
    {
      "matches": [
        "https://www.tiktok.com/*",
        "https://ads.tiktok.com/*",
        "https://www.instagram.com/*",
        "https://x.com/*",
        "https://www.xiaohongshu.com/*",
        "https://www.douyin.com/*",
        "https://creatormarketplace.tiktok.com/*",
        "https://www.datatool.vip/*",
        "https://www.youtube.com/*",
        "https://www.facebook.com/*",
        "https://www.bilibili.com/*",
        "https://space.bilibili.com/*",
        "https://search.bilibili.com/*",
        "https://chatgpt.com/*",
        "https://chat.openai.com/*",
        "https://www.doubao.com/*",
        "https://chat.deepseek.com/*",
        "https://www.kimi.com/*",
        "https://kimi.moonshot.cn/*",
        "https://claude.ai/*",
        "https://chat.x.ai/*",
        "https://grok.com/*",
        "https://gemini.google.com/*",
        "https://www.kwai.com/*",
        "https://www.kuaishou.com/*",
        "http://test.fmpets.cn:8106/*",
        "https://vimeo.com/*",
        "https://www.xinpianchang.com/*"
      ],
      "resources": [
        "inject.6070000c.js"
      ]
    }
  ]
}

by ✦ Astarte

DataTool-Video Downloader

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (216 total):

Raw Manifest

Detections

Manifest Findings