[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

TikTok Downloader, Sort & Analytics | KOLSprite

Version 2.2.1 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: https://www.kolsprite.com/

Rating: 4.5 ★ (213 ratings)

Users: 100,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 3 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
storage
sidePanel

Optional Permissions:

scripting

Host Permissions:

*://*.tiktok.com/*
*://*.kolsprite.com/*
*://plugin-data.kolsprite.com/*
*://*.bing.com/ttranslatev3/*
*://*.tiktokcdn.com/*
*://*.tiktokcdn-eu.com/*
*://*.tiktokcdn-us.com/*
*://*.tiktokv.com/*

Embedded URLs (120 total):

https://discord.com/invite/fUkmVhNSBC	https://mjjl.cn/DLtk37
https://www.kolsprite.com/kol/promotional/	https://www.kolsprite.com/blog/extension-install
https://www.kolsprite.com/blog/User-Guide	http://www.w3.org/2000/svg
https://www.tiktok.com/@	https://github.com/pmndrs/zustand/discussions/1937
http://jedwatson.github.io/classnames	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
https://www.kolsprite.com/v1/plugin	https://www.kolsprite.com
https://chat.deepseek.com/	https://chatgpt.com/
https://www.doubao.com/chat/	https://gemini.google.com/
https://claude.ai/new	https://grok.com/
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	https://www.kolsprite.com/blog/extension-update
https://www.kolsprite.com/price	https://www.kolsprite.com/kol/personal?type=rights
https://etdxr3a3ez.feishu.cn/share/base/form/shrcnHx8zUTnhUZ8u4DvF27zBFg	https://etdxr3a3ez.feishu.cn/share/base/form/shrcnSQzPYCpj0hKqrt8n3LwGjc
https://etdxr3a3ez.feishu.cn/share/base/form/shrcnyMY0dgakA7pXnV7arkhKRc	https://www.kolsprite.com/kol/collect?lang=
https://www.tiktok.com	https://www.tiktok.com/search?q=
https://www.kolsprite.com/tiktok-test	https://www.kolsprite.com/kol/workbench
https://www.kolsprite.com/price?#	https://www.kolsprite.com/img/allcountry/
https://www.kolsprite.com/blog/tiktok-comment-analysis-ai-user-guide	http://127.0.0.1
http://127.0.0.1:80	https://lodash.com/
https://openjsf.org/	https://lodash.com/license
http://underscorejs.org/LICENSE	https://npms.io/search?q=ponyfill.
https://github.com/exceljs/exceljs/blob/master/UPGRADE-4.0.md	http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument
http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet	http://schemas.openxmlformats.org/officeDocument/2006/relationships/calcChain
http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings	http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles
http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme	http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink
http://schemas.openxmlformats.org/officeDocument/2006/relationships/image	http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties
http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties	http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments
http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing	http://schemas.openxmlformats.org/officeDocument/2006/relationships/table
http://schemas.openxmlformats.org/spreadsheetml/2006/main	http://schemas.openxmlformats.org/officeDocument/2006/relationships
http://schemas.openxmlformats.org/markup-compatibility/2006	http://schemas.microsoft.com/office/spreadsheetml/2010/11/main
http://schemas.openxmlformats.org/officeDocument/2006/extended-properties	http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes
http://schemas.openxmlformats.org/package/2006/content-types	http://schemas.openxmlformats.org/package/2006/metadata/core-properties
http://purl.org/dc/elements/1.1/	http://purl.org/dc/terms/
http://purl.org/dc/dcmitype/	http://www.w3.org/2001/XMLSchema-instance
http://schemas.openxmlformats.org/package/2006/relationships	http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
http://schemas.openxmlformats.org/drawingml/2006/main	http://schemas.microsoft.com/office/drawing/2014/main
http://schemas.microsoft.com/office/excel/2006/main	http://schemas.microsoft.com/office/spreadsheetml/2009/9/main
http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing	http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
http://schemas.microsoft.com/office/spreadsheetml/2015/02/main	http://schemas.microsoft.com/office/spreadsheetml/2014/revision

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_main_title__",
  "icons": {
    "16": "src/assets/img/logo128.png",
    "32": "src/assets/img/logo128.png",
    "48": "src/assets/img/logo128.png",
    "128": "src/assets/img/logo128.png"
  },
  "action": {
    "default_icon": {
      "16": "src/assets/img/logo128.png",
      "24": "src/assets/img/logo128.png",
      "32": "src/assets/img/logo128.png"
    },
    "default_popup": "src/popup/index.html"
  },
  "version": "2.2.1",
  "background": {
    "type": "module",
    "service_worker": "service-worker-loader.js"
  },
  "options_ui": {
    "page": "src/options/index.html",
    "open_in_tab": true
  },
  "side_panel": {
    "default_path": "src/sidepanel/index.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_main_description__",
  "permissions": [
    "tabs",
    "storage",
    "sidePanel"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "assets/inject.ts.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "*://*.tiktok.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "assets/content.ts-loader.js"
      ],
      "css": [
        "assets/index4.css",
        "assets/content.css"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.tiktok.com/*",
        "*://*.kolsprite.com/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    }
  ],
  "host_permissions": [
    "*://*.tiktok.com/*",
    "*://*.kolsprite.com/*",
    "*://plugin-data.kolsprite.com/*",
    "*://*.bing.com/ttranslatev3/*",
    "*://*.tiktokcdn.com/*",
    "*://*.tiktokcdn-eu.com/*",
    "*://*.tiktokcdn-us.com/*",
    "*://*.tiktokv.com/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "scripting"
  ],
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "src/assets/icon/*",
        "src/assets/img/icon/*"
      ],
      "use_dynamic_url": false
    },
    {
      "matches": [
        "*://*.tiktok.com/*"
      ],
      "resources": [
        "assets/inject.ts.js"
      ],
      "use_dynamic_url": false
    },
    {
      "matches": [
        "*://*.kolsprite.com/*",
        "*://*.tiktok.com/*"
      ],
      "resources": [
        "assets/comment-ai-star.svg",
        "assets/comment-ai-arrow.svg",
        "assets/icon-refresh.svg",
        "assets/icon-download.svg",
        "assets/icon-export.svg",
        "assets/icon-to-top.svg",
        "assets/comment-translate.svg",
        "assets/comment-dark-translate.svg",
        "assets/comment-export.svg",
        "assets/logo-white.png",
        "assets/robot-nocomment.svg",
        "assets/logo-text-row-white.png",
        "assets/en-logo-white.png",
        "assets/icon-analysis.svg",
        "assets/icon-download2.svg",
        "assets/icon-collect.svg",
        "assets/icon-collaboration.svg",
        "assets/icon-product.svg",
        "assets/icon-similar.svg",
        "assets/logo-sprite.svg",
        "assets/en-logo-blue.png",
        "assets/copy.svg",
        "assets/copy-search.svg",
        "assets/chatgpt-logo.svg",
        "assets/deepseek-logo.svg",
        "assets/doubao.png",
        "assets/gemini-logo.svg",
        "assets/claude-logo.svg",
        "assets/grok-logo.svg",
        "assets/shield.svg",
        "assets/copy2.svg",
        "assets/send.svg",
        "assets/close.svg",
        "assets/logo128.png",
        "assets/subtitles.svg",
        "assets/excel.svg",
        "assets/xiangsi.svg",
        "assets/vip.svg",
        "assets/qunota-back.svg",
        "assets/feature.svg",
        "assets/logo-text-row.png",
        "assets/nopermission.svg",
        "assets/script.svg",
        "assets/index.js",
        "assets/hosts.js",
        "assets/url.js",
        "assets/content.ts.js"
      ],
      "use_dynamic_url": false
    }
  ],
  "optional_host_permissions": [
    "*://*.doubao.com/*",
    "*://chatgpt.com/*",
    "*://grok.com/*",
    "*://claude.ai/*",
    "*://gemini.google.com/*",
    "*://chat.deepseek.com/*"
  ]
}

by ✦ Astarte

TikTok Downloader, Sort & Analytics | KOLSprite

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (120 total):

Raw Manifest

Detections

Manifest Findings