last30days

This code locates browser profiles and extracts caller-specified cookie values, including authentication cookies, from Firefox and delegates other supported browsers to separate macOS modules. It creates and removes a temporary SQLite snapshot and returns cookie values to its caller; no exfiltration or destructive behavior is shown here. This is a sensitive credential-access capability and should only be used with authorization; severity is moderate to high if invoked without user consent. Relevant paths include cookies.sqlite, profiles.ini, /mnt/c/Users, /proc/version, and XDG_CONFIG_HOME; no domains, URLs, IPs, or credential values are present.

This module searches macOS Chromium-family browser profiles and retrieves requested cookies, including decrypting protected values using Safe Storage credentials obtained from Keychain. This is a high-impact credential-access capability and should only be used with explicit authorization; the fragment contains no network exfiltration or other clear evidence of malware. Severity is high for unauthorized use because session cookies can enable account access. No hardcoded external domains, URLs, IP addresses, or targeted environment variables are present.

This module is a high-sensitivity credential-handling component: it specifically reads Twitter/X session cookies (auth_token and ct0) from environment variables or from local browser cookie stores (via a third-party helper) and then constructs and returns an HTTP Cookie header containing those secrets. While it shows no direct exfiltration or malicious payload execution within this snippet, the capability to harvest authentication material is inherently dangerous if misused or if the dependency/downstream request handling is compromised. The dynamic import of @steipete/sweet-cookie adds supply-chain execution risk. Review downstream usage of the returned cookieHeader and ensure strict protection of logs, telemetry, and network destinations.

No clear malware behaviors are evident in this fragment (no eval/dynamic execution, no local persistence, and no explicit data exfiltration beyond normal HTTP requests). However, there is a significant security anomaly: getBaseHeaders() hardcodes an Authorization Bearer token in addition to accepting/storing user-provided auth cookies and CSRF token, which materially increases credential exposure and supply-chain risk. The module also suppresses errors during query-id refresh, which can reduce operational transparency. Because the snippet is incomplete beyond ensureClientUserId(), full determination of destinations and how responses are handled is not possible here.