last30days

SUSPICIOUS. The core capability matches a multi-source research skill, but it has a broad credential footprint, persistent local write behavior, third-party scraping/data routing, and high indirect prompt-injection exposure from untrusted content combined with Bash and Write access. This looks more like an overpowered research agent than confirmed malware.

This fragment is primarily an authentication/config loader that aggregates secrets from environment variables, local .env files, Codex auth JSON, macOS Keychain, and optionally browser cookies. There is no direct evidence of command execution beyond Keychain access or network exfiltration within this file. The main security concern is the ability to extract and load browser cookies into tokens (high privacy/credential-access risk) and the broad Keychain secret retrieval via subprocess. More context from the rest of the package is needed to determine whether the collected credentials are later transmitted or misused.

No clear evidence of overt malware (no eval/exec, no reverse shell, no destructive file ops) is present in this fragment. However, the code performs sensitive actions: it invokes a browser-cookie extraction routine and executes auth/token exchanges with a third-party API to obtain an API key, plus it persists setup flags to disk and runs system package installs (brew, gh CLI). This makes it security- and privacy-sensitive; review cookie_extract implementation and verify what data is transmitted to api.scrapecreators.com.

The module is a sensitive-data extraction utility focused on harvesting browser cookies. It locates Firefox profiles, copies and queries cookies.sqlite (moz_cookies) for caller-specified domain and cookie names, and returns the resulting cookie values—an authentication/session theft pattern. It also includes WSL support to access Windows Firefox profiles from Linux, increasing potential impact. No direct network exfiltration or obfuscation is present in this snippet, but the returned cookie material can readily be exfiltrated by downstream code, making the supply-chain risk high.

This module implements macOS Chrome/Brave cookie extraction and decryption by reading the browser cookies database, retrieving the browser encryption key from the Keychain, decrypting v10 cookie values via openssl, and returning plaintext cookies to the caller. This is a classic session/credential theft capability and would be highly suspicious in an untrusted dependency. Treat the package as potentially malicious unless there is a clear, documented legitimate use case and strict user consent/authorization.