last30days

SUSPICIOUS: the core research purpose is legitimate and largely aligned, but the actual footprint is unusually broad. Browser-cookie extraction, many optional credentials, third-party API/gateway routing, external CLI/binary installs, transitive tool/skill installation, and optional public publishing make this a high-risk research skill even without clear malicious intent.

This module is primarily an installer/auth/setup utility. It has notable security/supply-chain risks: it executes external installers via brew and especially npx (runtime installation/execution of Node packages and CLI binaries), and it can optionally extract browser cookies (highly sensitive data) when allow_browser_cookies=True. It also persists and writes API keys to local config. There is no direct evidence of hidden backdoors, obfuscated payloads, or direct system damage in this fragment, but the presence of sensitive credential/session handling and runtime dependency installation warrants review of transitive dependencies and downstream usage of extracted cookies.

High-risk supply-chain behavior. This module implements targeted extraction of sensitive browser cookie values from local profile databases (notably Firefox via moz_cookies), including multi-profile probing and WSL-based access to Windows Firefox profiles. While it does not directly show network exfiltration in this fragment, it clearly harvests session/auth material and returns it to the caller, which typically enables account takeover/session hijacking in surrounding code. macOS cookie extraction relies on additional helper modules that must be audited as well.

This module has high security significance: it locates Chromium-family browser cookie SQLite databases on macOS, retrieves required decryption material from the macOS Keychain via the `security` CLI, and decrypts `v10` encrypted cookie values using OpenSSL to return plaintext cookies to the caller. That workflow closely matches session/authentication cookie harvesting and is typically used for account takeover or tracking/exfiltration in other components of a broader package. While no network exfiltration is shown in this snippet, the returned decrypted cookies constitute extremely sensitive data and strongly suggest malicious intent or misuse potential.

This module is a sensitive authentication-cookie utility: it collects auth_token and ct0 from environment/CLI or from local browser profiles (Safari/Chrome/Firefox) and constructs a Cookie header for downstream authenticated requests. Within the shown code, there is no direct exfiltration, persistence, or command execution; the primary security concern is credential-handling and supply-chain exposure from dynamically loading @steipete/sweet-cookie. If the broader application uses the returned cookie header to make authenticated requests, misuse or compromise of the caller would substantially increase impact.