google-messages

This fragment implements an in-browser “message/conversation” watcher using both MutationObserver and polling, maintaining internal queues/state and exposing them globally. It explicitly logs WEBHOOK_URL and exports it in window._smsObserver.config, strongly indicating detected message events are intended for external forwarding via that webhook in the unseen portions of the module. While the exact network request implementation is not present here, the overall behavior pattern and endpoint handling present a high likelihood of sensitive data collection/exfiltration risk if used outside a clearly authorized context (e.g., a trusted first-party integration).

No definitive malware/backdoor indicators (no persistence, no remote command-and-control, no credential theft, and no explicit network exfiltration to attacker-controlled domains) are present in this module alone. However, the code is security-sensitive because it executes an external notification binary based on unauthenticated, untrusted inbound HTTP data and logs full inbound payloads. The dominant risk is operational abuse/side effects (unintended notifications, sensitive-data leakage to logs) and availability risk (no request size limit), rather than covert malicious code.

This module is an injection-and-forwarding harness: it enumerates an open Google Messages tab, establishes a CDP WebSocket connection, and uses Runtime.evaluate to execute a local sms-observer.js payload inside that tab while configuring it with a webhook URL. That combination strongly indicates privacy-invasive monitoring and potential exfiltration of sensitive SMS/message content. The highest-confidence security concern is the cross-context code execution via CDP plus webhook forwarding; the secondary concern is runtime npm installation if dependencies are missing. The precise data collection/transmission behavior cannot be confirmed without sms-observer.js, so malware intent is not provably certain from this snippet alone.

This module is not overtly malicious in the classic sense (no backdoor/persistence/credential theft/command-and-control evident in the snippet). However, it performs privacy-invasive scraping of a user’s message content and forwards message previews externally, while also persisting the scraped previews locally and emitting them to stdout. The primary security concern is abuse/exfiltration-by-design and operational/privacy exposure; additionally, deduplication is weak and relies on preview substring matching, which could amplify repetitive notifications.