Is Audio Downloader Prime safe?
We analyzed Audio Downloader Prime version 0.3.1's actual code and gave it a 68/100 trust score. Audio Downloader Prime fits its purpose but has broad…
Bottom line
Audio Downloader Prime fits its purpose but has broad browsing visibility and records visited-page details, without evidence of external misuse.
What it can access
It can monitor requests and page URLs across all websites, storing browsing-derived audio details for its feature.[Q1][Q2][Q12]
Security weaknesses
No meaningful weakness was found: websites cannot directly command it, and it does not modify traffic or expose privileged files.[Q16][Q18][Q21]
Signs of misuse
It records browsing and audio details locally, but there is no evidence that captured information is sent elsewhere or used for unrelated purposes.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to requests on every website, browser storage, downloads, and webRequest. All-site request visibility is powerful, but it directly supports finding audio resources; downloads are initiated from the popup after the user chooses an item.
Grants *://*/* plus storage, downloads, and webRequest. — manifest.json:6,20-24
Registers a response-header listener for every site and classifies matching audio requests. — lib/common.js:57-60,134-188
The popup download handler passes the selected captured URL to chrome.downloads.download. — lib/common.js:104-108
Which websites can it run on, and can it read or change what appears on those pages?
It can observe request URLs and selected response headers on every HTTP or HTTPS site. It does not inject a page access and has no code that reads or changes page page content.
Declares global host access and webRequest but no content_scripts or scripting permission. — manifest.json:6-24
Installs a passive onHeadersReceived listener. — lib/webrequest.js:1-23
Uses request metadata only to identify and record audio resources. — lib/common.js:134-188
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Only reads response headers (content-type, content-length, etc.), not request bodies or form data. — lib/common.js:140-155
No content scripts to access DOM input elements. — manifest.json:no content_scripts
Listener is onHeadersReceived (response side only), not onBeforeRequest or onSendHeaders. — lib/webrequest.js:14-20
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It sees current top-level page URLs, active-tab URLs and titles, audio-resource URLs, and selected response headers while browsing. It does not request cookie, history, bookmarks, or download-history reading services.
Records current tab navigation and associates detected media URLs, headers, and the tab title with the page. — lib/common.js:89-97,134-183
Requests downloads and webRequest, but not cookies, history, or bookmarks. — manifest.json:20-24
Uses downloads.download to start a selected download; it does not enumerate download history. — lib/chrome.js:5-14
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It opens the vendor homepage with extension version and install, update, or uninstall reason in the URL. I found no code that sends captured page URLs, titles, response headers, or audio URLs to the vendor or any analytics service.
Builds HTTPS vendor URLs containing version, previous version, and lifecycle reason for install/update tabs and the uninstall URL. — lib/runtime.js:1-21
Captured request data flows into extension session state rather than a network request. — lib/common.js:134-188
Stores page and audio state through chrome.storage.session. — lib/config.js:35-69
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads only packaged JavaScript files with importScripts. — background.js:1-5
The only fetch reads the packaged relative file explore/explore.json. — data/popup/explore/explore.js:17
Contains no externally supplied code source or externally_connectable declaration. — manifest.json:1-42
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically opens the vendor homepage after first installation and after an update only when at least 45 days have passed since the last such page. It also registers an uninstall URL.
Sets the uninstall URL and opens the vendor homepage for installs or qualifying updates. — lib/runtime.js:4-21
Starts a media download only through the popup's download message. — lib/common.js:104-108
The user clicking a captured audio link sends the download request. — data/popup/popup.js:141-157
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists the five readable bundled worker modules. — background.js:1-5
The core capture and download flow is directly readable. — lib/common.js:1-212
Capture state, extension lists, and filtering logic are directly readable. — lib/config.js:1-264
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads fixed local module paths. — background.js:1-5
Its timer receives a function reference, not a code string. — lib/common.js:185
The popup timer also receives a function callback and uses local JSON only. — data/popup/explore/explore.js:1-94
Does it track the websites, pages, searches, or links you visit?
While enabled, it records current top-level navigation URLs and detected audio-resource URLs in session storage so the popup can group downloadable audio by site. By default the displayed audio list is keyed by domain rather than full page URL, but the per-tab stack still holds current full URLs.
Updates per-tab navigation and top-level URL state as tabs change and requests arrive. — lib/common.js:89-97,140-145
Stores top-page and audio-resource mappings in chrome.storage.session, reducing the default grouping key to a domain. — lib/config.js:35-69
Associates each detected audio URL and page title with the current page context. — lib/common.js:171-183
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Persists feature preferences locally while page and captured-audio state is routed to session storage. — lib/config.js:8-50
Lifecycle URLs include extension version and reason but no generated user ID. — lib/runtime.js:1-21
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Reads URL, request type, content metadata headers, and tab title for local audio classification. — lib/common.js:134-183
Requests responseHeaders access only; it does not request requestHeaders or blocking modification. — lib/webrequest.js:14-21
Does not declare cookies or a content-script/page-reading capability. — manifest.json:20-24
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content_scripts key, no clipboardRead/clipboardWrite permission, no tabs permission for content injection. — manifest.json:1-35
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, externally_connectable origins, or web-accessible resources. — manifest.json:1-42
Dispatches messages only when their path names the extension's popup or options page. — lib/runtime.js:24-49
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Registers onHeadersReceived (read-only listener); no blocking or modification APIs are used. — lib/webrequest.js:14-20
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Registers a non-blocking response-header listener. — lib/webrequest.js:14-21
Starts a fresh browser download from the user-selected URL. — lib/common.js:104-108
Does not request proxy or declarative network modification permissions. — manifest.json:20-24
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission, no WebSocket or localhost URLs in any declared or observed code path. — manifest.json:1-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All logic is plain JavaScript for header parsing, classification, and storage; no dynamic code execution. — lib/common.js:57-201
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts, externally_connectable, or web_accessible_resources entries. — manifest.json:1-42
Handles only internally labeled popup and options messages. — lib/runtime.js:24-49
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Contains fixed local format rules and user-configurable capture settings. — lib/config.js:100-264
The only time gate controls the vendor page shown after an extension update. — lib/runtime.js:10-16
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Per-request work is a few header reads and a string/regex classification; no iterative or resource-intensive processing. — lib/common.js:134-186
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or scripting permission. — manifest.json:1-42
Its site-facing logic is limited to passive request metadata inspection. — lib/common.js:134-188