Is SaveFrom.net helper safe?

Findings

Removed from Marketplace

Flags items that have been removed or delisted from the marketplace, potentially due to security vulnerabilities, or malicious behavior. Such extensions pose a risk as they are no longer maintained or patched.

high

Fraudulent Behavior Detected

Flags items that exhibit deceptive or intentionally misleading behavior, including impersonation of legitimate software, false claims about functionality, or use of fake publisher identities. These items are often designed to trick users into installation, collect sensitive information under false pretenses, or distribute malicious payloads. Fraudulent items pose significant risks to security, privacy, and trust in the ecosystem.

high

Broad Host Permissions

Flags items that declare overly broad host access patterns, enabling interaction with all websites. This level of access can be exploited to inject scripts into trusted sites and increases the risk of sensitive data exposure, cross-site surveillance, and credential harvesting.

medium

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

The SaveFrom.net Helper extension is designed to add download functionality to popular video and audio sites (YouTube, Facebook, VK, Instagram, TikTok, etc.). Its codebase is large and modular, focusing on extracting direct media links and providing UI elements for downloads.

Purpose and Intention

The extension injects content scripts into supported sites to detect media elements and provide download options.
It supports a wide range of sites by using site-specific logic to extract downloadable URLs for videos, images, and audio.
It interacts with the browser's storage, messaging, and i18n APIs for settings, communication, and localization.

API Calls and Network Activity

Uses chrome.runtime.sendMessage and chrome.storage.local for extension communication and settings.
Makes network requests to fetch media metadata, video links, and subtitles, often using fetch or XHR to the target sites (e.g., YouTube, Facebook, Instagram, VK, OK.ru, Twitter, SoundCloud, etc.).
Some requests are proxied through the extension's background scripts for cross-origin support.
No evidence of exfiltration of user data to third-party servers unrelated to the extension's functionality.

Filesystem and Process Execution

Uses the browser's download API to trigger downloads, and in some cases, creates blobs and triggers downloads via anchor elements.
No evidence of arbitrary code execution, process spawning, or filesystem access outside the browser's download capabilities.

Obfuscation and Code Structure

The code is minified for performance but not obfuscated. Variable names are shortened, but logic is readable and not intentionally hidden.
No string encryption, control flow flattening, or anti-analysis techniques are present.

Potentially Sensitive Behaviors

The extension interacts with cookies for some sites (e.g., YouTube) to synchronize cookies for API requests, but this is within the context of enabling downloads.
It injects iframes and scripts to extract media links, but these are targeted at the current site and not used for privilege escalation or data theft.
No evidence of backdoors, hidden command-and-control, or data exfiltration.

Summary

The extension is a complex but legitimate media downloader. All network and API activity is consistent with its stated purpose. No strong indicators of malicious behavior are present.

Permissions

medium

clipboardWrite

api

Lets the extension cut and copy items to the clipboard using the web platform Clipboard API.

pending

includes/tiktok_com.js

resource

medium

storage

api

Enables persistent data storage for the extension, potentially storing large amounts of user-related information.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

chrome.webNavigation.getAllFrames

edge

/js/background.js

high

chrome.cookies.getAll

edge

/js/background.js

medium

chrome.runtime.id

edge

/includes/commons.js

All API calls are available for Enterprise users

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

TwitchAccessToken

/includes/twitch_tv.js

Unverified

All secrets are available for Enterprise users

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://fonts.googleapis.com/css2?family=Castoro:ital@0

includes/astrology.js

https://sf-helper.com/geoip/country.php

js/background.js

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900

includes/astrology.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

DEPENDENCIES ARE AVAILABLE FOR ENTERPRISE USERS

Licenses & Compliance

Compliance

Compliance status and certifications for the extension and its publisher

savefrom.net

Savefrom.net is ISO 27001 certified, as indicated by the mention of ISO 27001 compliance on their website. However, there is no information available regarding the parent company or its compliance status.

Compliant

Licenses

No license text available...