last30days

SUSPICIOUS. The core research behavior is coherent with the stated purpose, and most integrations are documented, but the skill has a broad footprint: sensitive cookie/token handling, third-party API routing, external tool installs, persistent local writes, and optional public publishing. This looks more like an overpowered research platform than clear malware, but its trust and data-exposure surface are larger than a typical research skill.

No explicit obfuscation or clear malicious payload (no eval/exec of untrusted strings, no direct reverse shell, no cryptomining, no file destruction) is present in this fragment. However, it performs highly sensitive actions: optional extraction of local browser cookies and automated installation of additional command-line tooling using npx/brew (runtime supply-chain execution). It also calls a remote API to complete a device flow and retrieve an API key, and it persists secrets to local env/config files. Overall, the primary security concern is supply-chain risk (npx installing external CLIs) combined with privacy-sensitive cookie harvesting and secret persistence.

This module is a high-sensitivity credential-handling component: it specifically reads Twitter/X session cookies (auth_token and ct0) from environment variables or from local browser cookie stores (via a third-party helper) and then constructs and returns an HTTP Cookie header containing those secrets. While it shows no direct exfiltration or malicious payload execution within this snippet, the capability to harvest authentication material is inherently dangerous if misused or if the dependency/downstream request handling is compromised. The dynamic import of @steipete/sweet-cookie adds supply-chain execution risk. Review downstream usage of the returned cookieHeader and ensure strict protection of logs, telemetry, and network destinations.

High-likelihood malicious intent: the module extracts and returns browser cookie values from local Firefox profiles (and, on macOS, delegates to other browsers), including reading Windows Firefox cookies via WSL-mounted paths. This is effectively credential/session theft (cookies) with broad auto-discovery of targets and no visible consent/authorization controls in this module. Review any package usage carefully; treat this dependency as dangerous.

This module contains a highly suspicious, targeted capability to harvest and decrypt Chromium-family browser cookies on macOS. It enumerates and copies browser cookie SQLite databases, obtains the necessary decryption passphrase from the macOS Keychain via `security`, decrypts v10 encrypted cookie values using OpenSSL, and returns plaintext cookie/session material for caller-selected domains and cookie names. Even without visible exfiltration in this snippet, the implemented behavior aligns strongly with cookie/session theft tooling and presents a critical privacy/security risk if included in a software supply chain.

This module is a macOS-specific parser that reads Safari’s local Cookies.binarycookies file and extracts selected cookie values for a provided domain and cookie name set. It contains no direct network exfiltration, command execution, or obfuscation in this fragment. The security risk is primarily its capability to harvest highly sensitive authentication/session cookies, which could be misused by other parts of a containing package. Additionally, the snippet shows a likely defect (`return resul`), which may impair execution but does not negate the sensitive extraction design.

No clear malware behaviors are evident in this fragment (no eval/dynamic execution, no local persistence, and no explicit data exfiltration beyond normal HTTP requests). However, there is a significant security anomaly: getBaseHeaders() hardcodes an Authorization Bearer token in addition to accepting/storing user-provided auth cookies and CSRF token, which materially increases credential exposure and supply-chain risk. The module also suppresses errors during query-id refresh, which can reduce operational transparency. Because the snippet is incomplete beyond ensureClientUserId(), full determination of destinations and how responses are handled is not possible here.