Video Download Helper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension’s manifest reports a description of "Download videos from the web. Easy, smart, no tracking." and the code base contains a set of injected helper scripts that each issue a fetch request. The findings show explicit network calls such as NET-FETCH-injected/vimeo.js-9 in injected/vimeo.js, NET-FETCH-injected/bilibili.js-6 in injected/bilibili.js, NET-FETCH-injected/kick.js-9* and *-6* in *injected/kick.js*, NET-FETCH-injected/chaturbate.js-9in *injected/chaturbate.js*, andNET-FETCH-injected/facebook.js-10in *injected/facebook.js*. These scripts are clearly intended to retrieve video data or metadata from the named platforms (Vimeo, Bilibili, Kick, Chaturbate, Facebook, YouTube, Canva, etc.). Another set of fetch calls originates from the core workers:NET-FETCH-download_worker/main.js-9in *download_worker/main.js* andNET-FETCH-service/main.js-18* and -40 in service/main.js. Additionally, a Socket.IO connection is opened from service/main.js (NET-SOCKET_IO-service/main.js-41). All of these network interactions are typical for a downloader that contacts the source sites to acquire video streams.

No findings indicate the presence of malware signatures, obfuscation, credential harvesting, or data exfiltration. The findings_summary reports zero IoCs, zero malware signatures, and zero obfuscation flags. The only other category present is the single manifest analysis finding, which does not raise any security concerns. There are no code‑smell or secret‑leak findings, and the extension does not request cookies, storage, or other sensitive permissions beyond what a downloader would need.

The extension name, Video DownloadHelper, matches a well‑known Firefox add‑on that is widely used for exactly this purpose. Although the developer_name field is blank, the user count exceeds 1.8 million, suggesting a mature and popular tool rather than a freshly published imposter. No typographic similarity to a different popular extension is observed, so impersonation is not a factor.

A skeptic might argue that the numerous fetch calls to many third‑party domains could hide unwanted tracking or serve as a conduit for malicious payloads. However, each call is tied to a specific site‑specific script (e.g., youtube.js, vimeo.js), and there is no evidence of these scripts transmitting user data to unknown endpoints, nor any indication of the extension modifying browser settings, hijacking the new‑tab page, or acting as a proxy. The absence of any data‑exfiltration or credential‑theft signatures, combined with the transparent purpose of the code, strongly mitigates that concern.

In summary, the extension behaves as advertised: it contacts video‑hosting services to retrieve media streams. Its behavior aligns with the functionality of a legitimate video‑download helper, and no malicious or high‑risk patterns were observed.

Key Reasons

• Only fetch calls to known video‑site scripts (e.g., injected/vimeo.js, injected/bilibili.js)
• No malware signatures, obfuscation, or credential‑stealing code detected
• Extension name matches a popular, legitimate downloader
• No network calls to suspicious or unknown domains

Reviewed 2026-05-23; recommended action: no action; model confidence 88%.