Overview
- Socket researchers published findings on Sept. 11 showing the cross-store extension “Twitch Enhanced Viewer | JeetBot” forwarded account-scoped OAuth tokens through operator-controlled proxies.
- The extension appended live Twitch OAuth tokens as an &auth= URL query parameter so the tokens were written in cleartext to proxy request logs and could be captured by the proxy operator.
- Earlier v4.x builds went further by POSTing captured tokens to a dedicated set-token endpoint on JeetBot infrastructure with backups on two Deno services, creating persistent storage of credentials.
- The code contained a hardcoded allowlist that exempted ten Russian-language channels from token forwarding, a design detail Socket says suggests intentional behavior rather than accidental leakage.
- The developer issued Firefox update v85.8.7 to stop forwarding and submitted a Chrome fix for review but Socket and reporters warn users to remove the extension and revoke all Twitch sessions to fully mitigate exposure.