Is this Ome.tv script safe?
Why scanners and AI assistants flag our loader, what the code really does, and what you can check yourself without taking our word for it.
- 3
- Websites the extension can touch
- 0
- Video frames uploaded by default
- None
- Access to your other tabs or passwords
Jump to a section
- 01The short version
- 02Why ChatGPT or Claude calls it malware
- 03Ask it again with the missing half
- 04So why is it obfuscated at all?
- 05The same pattern, different answers
- 06What you can actually check yourself
- 07The permission list in full, so you do not have to go and find it
- 08Things we will never ask you to do
- 09What leaves your computer, and what does not
- 10About the video analysis specifically
- 11The one thing that genuinely lowers a defence
- 12How we decide these things
- 13What we are not claiming
- 14Still not comfortable?
The honest version, including the awkward parts
Written to be verified rather than believed. Where something genuinely deserves caution, it is on this page too.
The short version
If you read nothing else on this page, read these three.
The warning you saw is not wrong about the pattern
Our loader really does download code and run it. That is the same shape as a lot of genuinely malicious software, and any scanner is right to flag it on sight.
What a scanner cannot see is the other end
It has no way to know what is at the far end of that download, who controls it, or what it is allowed to touch. That is the actual question, and it is answerable.
You do not have to read our code to be safe
The extension is obfuscated, all of it, and we say so plainly below. What keeps you safe is not the code but the boundary your browser puts around it, and that boundary you can read.
Why ChatGPT or Claude calls it malware
People paste our loader into an AI assistant and get told it is dangerous, often with a confident number attached. Here is exactly what it is reacting to, because it is worth understanding rather than dismissing.
The code is deliberately unreadable
Names are scrambled and text is encoded, so nothing explains itself. Hiding intent is the first thing a scanner looks for.
It downloads something
It sends a token to a server and gets back an encrypted block of code.
It decrypts what came back
Encryption in a downloaded payload usually exists to stop anybody inspecting it.
It runs that downloaded code
The last line hands the decrypted text to the browser to execute. This is the closest thing to a universal malware signature there is.
The extension weakens a security header
On ome.tv only. It has its own section below, because it is a real cost and not a footnote.
All five at once is the classic shape
Any one of them is unremarkable. Together they are the textbook description of a dropper.
A confidence number is not a scan result
When an assistant says something like "90% likely malicious", it is expressing how strongly the shape matches a pattern it has seen, from perhaps forty lines of scrambled code with no idea what is on the other end of the request. It is not a measurement, nothing was executed, and no server was contacted. Given only the wrapper, that answer is the responsible one for it to give. It would say the same about the auto-updater inside software you already trust.
Ask it again with the missing half
If you are going to ask an assistant about this, ask it properly. Pasting the script on its own gives it the five things that look worst and nothing that bounds them, so it reasons to the worst case because that is the only case it was handed. This gives it both halves: what the extension does that looks alarming, and the true facts that decide how far any of it can actually go. Then it asks for an accurate reading rather than a dramatic one.
I am deciding whether to install a browser extension, and I want an
accurate reading rather than a dramatic one. I am giving you both the parts
that look alarming and the facts that bound them, because judging it on the
alarming half alone would overstate the risk. Weigh all of it.
WHAT IT IS
A Manifest V3 browser extension, "ome.undfnd loader", for the video-chat site
ome.tv. It overlays the connection details of the person I am matched with.
It is NOT from a web store: I install it myself as an unpacked folder, it
shows up in my browser's extension list, and I remove it from there. There is
no installer and it puts nothing into my operating system.
WHAT ITS MANIFEST DECLARES (this is the enforced boundary)
permissions: storage, scripting, alarms, declarativeNetRequest
host_permissions: https://ome.tv/*
https://ome.undfnd.eu/*
https://*.undfnd.eu/*
THE PARTS THAT LOOK ALARMING
- Every JavaScript file in it is obfuscated. I cannot read any of it.
- It sends a token to the vendor's server and gets back an encrypted script,
decrypts it, and runs it in the ome.tv page.
- It pauses in the debugger if I open developer tools.
- It uses a declarativeNetRequest rule to remove the Content-Security-Policy
header, on ome.tv only, so its overlay is allowed to run in that page.
THE FACTS THAT BOUND THEM
- The obfuscated code still runs inside the browser's extension sandbox. It
is confined to the three hosts above and cannot widen that at runtime.
- The manifest has no nativeMessaging, no downloads, no tabs, no history, no
<all_urls>. So the "run downloaded code" step, however bad it looks, has
no reach outside ome.tv and the vendor's own domains.
- The extension's actual job is reading the OTHER person's incoming video to
show the overlay. It is not a recorder: there is no MediaRecorder and
nothing is written to disk or queued for upload.
- The CSP removal is scoped to ome.tv by the rule and does not touch any
other site's headers.
- The requests it makes are signed with a token that is tied to one account
and expires in seconds, and each build is personal, so a copied script
does not work for anyone else.
WHAT I WANT FROM YOU
1. Given those permissions, what can this extension reach, and what is it
unable to reach even if its code is malicious?
2. What is the realistic worst case if the vendor is dishonest or is breached
later? In your answer, compare that worst case to two things I already
accept: trusting the ome.tv website itself with my camera while I use it,
and trusting any auto-updating program to fetch and run new code. Is the
extension's worst case larger than those, the same, or smaller, and why?
3. Does removing that header on ome.tv affect any other site I visit?
4. Which of my concerns does the permission boundary genuinely settle, and
which ones does it not touch at all?
Treat the obfuscation as a real limitation, not something to wave away, but do
not describe reach the permissions do not allow. "Rootkit" or "records your
webcam and files" would contradict the manifest above; if you use language
like that, explain how the permissions permit it or leave it out.This is not rigged to make it say "safe"
A good answer to this still tells you the code is unreadable, that you are trusting our servers, and that a breach on our side would reach ome.tv. We put those same three in "What we are not claiming" below. What changes is that the assistant now has the facts that bound the worst case instead of only the facts that inflate it, so what you get back is proportionate rather than a rootkit verdict reasoned from five scary lines. Every fact in the prompt is checkable against the sections on this page before you paste it.
So why is it obfuscated at all?
This is the fair follow-up question, and the answer is a trade we made knowingly.
- Ome.tv actively works to detect and break overlays like ours
Readable code makes that trivial: they can match on our function names and stop the script in an afternoon. This is the main reason, and it is an ongoing back and forth rather than a one-time thing.
- Your build carries a key that belongs to you
Each script is personal and holds a token bound to your account and your device. Plain code makes lifting that token out of a screenshot considerably easier.
- It is a paid product that gets copied
Being straightforward about the commercial reason rather than dressing it up as security: this is one of the reasons.
- The whole extension is obfuscated, not just the overlay
Every JavaScript file in the download is scrambled, and the overlay actively resists being stepped through in developer tools. We are not going to pretend otherwise, and the section below is built around it: you check the boundary the browser enforces, not the code we wrote.
- The cost of that choice is this page
Obfuscation is exactly why scanners and assistants flag us, and we cannot claim that is unfair while doing the thing that causes it. So the honest offer is not "read our code and see", it is "you do not have to, and here is why".
The same pattern, different answers
A comparison that concedes the first two rows, because pretending otherwise would be the tell. What separates the two is not the technique, it is who controls it and what it is allowed to reach.
| Feature | A malicious dropper | This loader |
|---|---|---|
| Runs code downloaded from a server | Included | Included |
| The code is obfuscated | Included | Included |
| Arrives without you choosing to install it | Included | Not included |
| Hides itself from the list of installed extensions | Included | Not included |
| Can run on any website you visit | Included | Not included |
| Websites it is allowed to touchome.tv and our own two domains, listed in the manifest and shown by your browser at install time. | All of them | Three |
| The permissions it needs are shown to you upfrontA dropper takes what it can reach; a browser extension has to declare it, and the browser shows you the list before you install. | Not included | Included |
| Reads passwords, form fields or other tabs | Included | Not included |
| Removing it fully removes it | Not included | Included |
Downloading and running code is normal, in the right box
Your browser does it on every page you open, and every auto-updating program on your computer does it in the background. The security question was never whether code arrives over a network. It is what the code is allowed to reach once it arrives, which for a browser extension is decided by the browser and not by us.
What you can actually check yourself
Not the code, that part is honestly closed. What you can check is the boundary the browser puts around it, which is the part that actually keeps you safe, and none of it needs our cooperation.
- 1
Read the permission list, which is not obfuscated
Open manifest.json in the extension folder. It is plain text: it asks for storage, scripting, alarms and network rules, and for access to exactly three web addresses, ome.tv and our two domains.
Show more detail
The JavaScript files next to it are scrambled and we are not pretending otherwise. This file is the one that matters, because it is the complete list of what the extension is allowed to do, and it cannot ask for more at runtime than what is written here.
- 2
Let the browser show you the same list at install
When you load the extension, your browser tells you what it can access. That prompt is the browser reading the same manifest, and it is the browser, not us, that enforces it.
Show more detail
This is the real guarantee on the whole page. An extension physically cannot touch a site that is not in its list, no matter what its code says or how obfuscated that code is. You are trusting your browser here, not our word.
- 3
Restrict it further yourself, any time
In your browser's extensions page, open the loader's details and set its site access to On specific sites. This is a browser control we cannot override.
Show more detail
It is also why "watch the Network tab" is not on this list: the overlay deliberately resists developer tools, so it would fight you rather than reassure you. Clamping the site access in the browser proves the boundary without reading a line of code.
- 4
Check it is gone when you remove it
Delete the extension from your browser and the folder from your disk. Nothing is installed outside those two places, nothing is left in Windows, and there is no background program.
Yes, the code fights inspection, on purpose
If you open developer tools on ome.tv, the overlay will keep pausing in the debugger. That is a deliberate anti-tampering measure, the same reason the files are obfuscated, and it is exactly the behaviour a scanner dislikes. We would rather tell you it is there than have you find it and assume we were hiding it. It does not change what the extension can reach, which is still only the three sites above.
The permission list in full, so you do not have to go and find it
This is the whole of manifest.json from the download, printed rather than described. It is the file the previous section asks you to read, it is the only part of the extension that is not scrambled, and it is the complete list of what the extension is allowed to do. Open your own copy and compare it: if the two differ, something is wrong and we want to hear about it.
{
"manifest_version": 3,
"name": "__MSG_extName__",
"version": "1.6.0",
"description": "__MSG_extDescription__",
"default_locale": "en",
"permissions": [
"storage",
"scripting",
"alarms",
"declarativeNetRequest"
],
"host_permissions": [
"https://ome.undfnd.eu/*",
"https://*.undfnd.eu/*",
"https://ome.tv/*"
],
"background": {
"service_worker": "background.js"
},
"action": {
"default_title": "__MSG_extName__",
"default_popup": "popup.html",
"default_icon": {
"16": "icon-16.png",
"48": "icon-48.png",
"128": "icon-128.png"
}
},
"commands": {
"load-now": {
"suggested_key": {
"default": "Alt+Shift+L"
},
"description": "__MSG_cmdLoadNow__"
},
"sync-now": {
"suggested_key": {
"default": "Alt+Shift+S"
},
"description": "__MSG_cmdSyncNow__"
}
},
"icons": {
"16": "icon-16.png",
"48": "icon-48.png",
"128": "icon-128.png"
},
"content_scripts": [
{
"matches": [
"https://ome.undfnd.eu/*"
],
"js": [
"content-dashboard.js"
],
"run_at": "document_idle"
},
{
"matches": [
"https://ome.tv/*"
],
"js": [
"content-ometv.js"
],
"run_at": "document_idle"
}
],
"declarative_net_request": {
"rule_resources": [
{
"id": "ometv_csp",
"enabled": true,
"path": "rules.json"
}
]
}
}The three lines that matter are the host permissions
Everything else in that file is plumbing. host_permissions is the boundary: ome.tv and our two addresses, and nothing else exists as far as this extension is concerned. Your browser enforces that list, it cannot be extended at runtime, and it does not matter how unreadable the code inside is. scripting lets it inject the overlay, but only into those same three places.
Things we will never ask you to do
Worth knowing because software that actually wants to harm you needs at least one of these, and asking is how it gets caught. If anything claiming to be us ever asks for one, it is not us.
Turn off your antivirus, or add an exclusion for us
Not in the install steps, not in a support ticket, not to fix an error. If a scanner objects to the download, the answer is this page, not a folder your antivirus stops looking at.
Run an installer, or approve an administrator prompt
The extension is a folder your browser loads. Nothing is installed into Windows, nothing asks for elevation, and there is no .exe to run.
Give us a password
Signing in goes through Discord and we never see your details. There is no password field anywhere on this site, so anything asking you for one is not us.
Send us a file, a screenshot of your screen, or remote access
Support is text. Nobody here will ask to connect to your computer or to have you run a command we sent you.
Two exceptions, and they are both on this site
The extension does remove one security header on ome.tv, which is the next section but one and not a footnote. And separately, the unban guide has a second route that involves installing an older browser and freezing its updates, which does leave that browser unpatched. It is optional, it is not part of using the product, and the route we recommend on that page needs none of it. We would rather point at both than have you find them and wonder what else is unlisted.
What leaves your computer, and what does not
The overlay analyses the video on the other side of your connection. That deserves a straight answer rather than a reassuring one, so here is the line, item by item.
| Feature | Stays on your device | Sent to our server |
|---|---|---|
| Video frames from the other person | Included | Not included |
| Video from your own cameraUntouched unless you switch the face-masking effects on, and even then the masking is drawn on your machine and only the finished video is sent to the person you are talking to. | Included | Not included |
| A face signature that could identify somebody | Included | Not included |
| Counters about a connectionHow long it lasted, how many frames were seen, how many were blank, and the best detection score. Folded into a daily total, with no per-connection record kept. | Not included | Included |
| One-way codes describing video contentUsed to spot the same recorded clip being played to many people. They describe a video, not a face, and cannot be turned back into an image. | Not included | Included |
| The network address you are connected toThis is the lookup itself, and the whole point of the product. | Not included | Included |
| A picture you deliberately attach to a noteOnly when you capture one yourself and leave it attached. There is a remove button, and this is the single case where an image is uploaded at all. | Not included | Included |
One concrete decision, so you can judge the rest
The face detection library used to be loaded from a public code hosting service. That meant every user who switched a camera rule on announced it, with their address and the ome.tv referrer, to a company we have no agreement with and could not audit. We copied the library onto our own servers so that request stops existing. Nobody asked for it and nobody would have noticed. It is the kind of thing this page is asking you to weigh.
About the video analysis specifically
Some features look at video. Here is exactly how far that goes, including the one that touches your own camera.
One frame at a time, then discarded
A single frame is grabbed from the incoming video, shrunk, inspected, and thrown away. Nothing is written to disk and nothing is queued for upload.
The analysis runs on your computer
Detecting a face, a blank camera or a looping recording all happen inside your browser. Your machine does the work, which is also why nothing needs to be sent.
The face features are off unless you turn them on
The detection library is only downloaded the first time you switch on a rule that needs it. If you never do, it is never fetched and never runs.
The recording check is plain arithmetic
Spotting a looped or frozen video compares patterns of light and dark between frames. There is no model, no face involved, and nothing that describes a person.
Your own camera, if you switch effects on
There is an optional feature that blurs or masks your face in the video you send out. Turning it on puts the overlay in the middle of your outgoing camera stream, which is worth knowing even though the purpose is to show people less of you rather than more.
That one is off until you enable it, and stays local
The masking is drawn on your machine and only the already-masked video is sent, to the person you are talking to and not to us. With the feature off, the overlay never touches your camera at all.
The one thing that genuinely lowers a defence
This is on the page because leaving it out is what would make everything above worthless. Four facts, in order.
What the rule normally does
Websites can tell your browser which code it is allowed to run on their pages. It is a good protection, and it exists to stop injected scripts.
We remove it, on ome.tv only
Our overlay is exactly the kind of injected script that rule is designed to block, so the extension strips it there. Nowhere else.
What that costs you, plainly
While the extension is installed, ome.tv loses one layer it would otherwise have. If anything else could inject code there, that layer would not stop it.
Check the scope yourself
Open rules.json in the extension folder. It is a single rule with ome.tv written into it in plain text. Every other site you visit is untouched.
The paste route does not do this at all
A script you run from the console is already inside the page, so nothing needs removing. If you would rather keep that header, the paste route is a real alternative rather than a consolation prize, and it is set up in Getting started.
How we decide these things
Not a promise, four decisions already in the code, so you can see the pattern rather than read a claim about it.
Third parties are removed, not added
The face library was pulled off a public host onto our own so users stop announcing themselves to a company we cannot audit. Every outside dependency gets that question asked of it.
A leaked script does not work for anybody else
Each build is tied to your account and to the browser it was made in, and it re-proves that on every request. Somebody who copies your script from a screenshot gets a refusal, not your account.
The script only runs where it is meant to
A build is locked to ome.tv. Pasted anywhere else it does nothing at all, which limits the damage if one ever ends up somewhere it should not.
Requests are signed and short-lived
Every call the overlay makes carries a signature that expires in seconds, so a captured request cannot be replayed later.
What we are not claiming
The limits of everything above, stated by us rather than found by you later.
This is not open source, and none of the code is readable
The whole extension is obfuscated, and the overlay resists developer tools on top of that. There is no readable version of it, and we are not going to imply there is. That is why the argument on this page is about what the code is allowed to reach, which the browser decides and you can inspect, rather than a line-by-line reading of what it does. If reading the code yourself is your bar for installing software, we do not meet it, and that is a reasonable bar to have.
You are trusting our servers, because the script is built there
The code that gets executed is assembled and encrypted on our side, which means a compromise of our servers would reach our users. That is true of every product that updates itself, ours included, and no amount of code reading on your end changes it. What limits the blast radius is the permission list: three websites, no access to your other tabs, no passwords, no files.
Warnings from scanners will keep happening
As long as the overlay is obfuscated, scanners and assistants will keep flagging it, and they are not malfunctioning when they do. We would rather explain that than ask you to add an exception and stop thinking about it.
What the product does can still be misused
Separate from whether the code is safe on your machine. It shows the rough location of a network, and people have tried to read that as somebody's address. What the overlay is showing you is direct about how wrong that reading is, and notes that target or expose somebody are removed.
Ome.tv does not endorse this
We are not affiliated with them. Using an overlay on their site is between you and their terms of service, and we cannot tell you it carries no risk to your account there.
Still not comfortable?
That is a legitimate place to land, and we would rather you stayed there than installed something you had doubts about. If you want a specific claim on this page checked, ask in a support ticket and point at the file: everything referenced here is in the zip you can download without installing anything.
If you find something on this page that is wrong, tell us and we will correct it here. A transparency page that quietly goes stale is worse than not having one.
Still stuck?
Tell us which browser you are on, whether you use the extension or paste the script, and what you see on screen. Those three things save a whole round of questions.