Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, distributed through the official Chrome Web Store and Mozilla Add-ons, forwarded OAuth session tokens to proxies under the control of its operator. With these tokens, an attacker can hijack accounts without needing the password or bypassing two-factor authentication, allowing actions ranging from reading and sending whispers to writing in chat and altering linked account settings.
The tokens function as bearer credentials: anyone in possession can impersonate the user on Twitch. The most critical behavior appeared in the v85.x branch, which added the token as the &auth= query parameter during network-level redirects to operator-controlled proxy servers. Because the token traveled inside URLs, it could remain in clear text inside proxy logs, greatly increasing exposure if those logs were accessed improperly or leaked.
The forwarding occurred for nearly every channel a user opened, with the sole exception of a hardcoded list of ten channels. Starting with version 85.8.4, the extension also exposed a Channels with restrictions setting that gave an appearance of control while the underlying exfiltration continued. Earlier v4.x releases had already sent tokens via POST to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net.
Remediation and Recommendations
The corrected version for Firefox, 85.8.7, eliminates token transmission by changing the playlist retrieval method. An equivalent Chrome update is being prepared. Updating or disabling the extension stops further leakage but does not invalidate tokens already sent. Users should therefore uninstall or disable Twitch Enhanced Viewer | JeetBot immediately, close all active Twitch sessions from account settings, and re-authenticate to force session rotation. Reviewing recent activity, private messages, and chat actions is also recommended.
In managed environments the incident highlights the classic supply-chain risk posed by extensions that can intercept or redirect traffic for authenticated services. Basic hygiene includes maintaining an inventory of installed extensions, blocking the affected identifiers pnhhdhhcadcjfckjhpmjneldiegbojfb in Chrome and twitchenhancedviewer@example.com in Firefox, and enforcing allow-lists on corporate browsers.
Related articles
Malicious ZIP Archive Delivers Git-Based Remote Code Execution via Hooks and Filters
A developer received a fake job offer from Cryptic Heaven through LinkedIn, leading to a ZIP file containing a rigged Git repository. The archive included a pre-configured .git directory with altered hooksPath pointing to .git/objects/interrupt and a custom clean filter named ltr. Upon git status or branch checkout, the setup triggered a shell script that downloaded and executed remote code from a server hosted on vercelscript.vercel.app. The attack leveraged post-checkout hooks and Git filters to run silently without requiring install scripts or explicit execution. Multiple trigger paths existed, including automatic detection in Visual Studio Code, Git-aware terminal prompts, and following README instructions to switch branches. The technique worked on both Linux/macOS and Windows through Git for Windows shell support. The incident highlights risks of opening untrusted Git repositories delivered outside standard clone workflows.
OIDC-Based Push Deployment on VPS Removes SSH Keys from CI While Enforcing Strict Isolation
A new self-hosted deployment system called cd enables secure continuous delivery to single Linux VPS hosts running Docker without storing any long-lived secrets in CI repositories. The architecture relies on short-lived OIDC JWT tokens issued by GitHub Actions or GitLab CI, verified on the target server through JWKS public keys. The server component cdd performs token validation, archive checks, resource-limited builds inside BuildKit, health checks, and automatic rollback on failure. All containers are launched with read-only root filesystems, dropped capabilities, no-new-privileges, and network binding restricted to 127.0.0.1 behind Caddy or Nginx. Administrative control is provided by the cdctl CLI that registers projects, sets RAM/CPU limits, and manages DNS records via Porkbun integration. The entire solution avoids external databases, web panels, and persistent secrets while enforcing one-repository-to-one-application boundaries.
Stolen Credentials Poison cPGuard Update Channel, Turning Security Software into Data Theft Backdoor
Attackers used compromised OPSSHIELD credentials to hijack the cPGuard update distribution network on November 2 at 02:06 UTC, injecting malicious scripts into versions 5.88.12 through 5.88.19. The poisoned updates targeted Linux servers running the security tool, which holds root privileges on hosting provider and cloud infrastructure machines. The script harvested /etc/shadow, /etc/passwd, MariaDB/MySQL root credentials from my.cnf, root shell history containing API tokens, and SSH authorized_keys files before exfiltrating them via the vendor's own infrastructure. A persistent backdoor was also dropped at /var/tmp/.cpg91511_sh. OPSSHIELD detected the intrusion within 12 hours and halted distribution, but confirmed that 32 customer servers had their data accessed. The incident highlights risks of relying on static credentials for security product update pipelines without code signing or behavioral restrictions.
Polymarket Suffers Supply Chain Attack via Compromised DebugBear Monitoring Script
Attackers compromised DNS records of DebugBear, a real user monitoring provider, to inject malicious JavaScript into Polymarket pages. The script extracted wallet data and trading credentials from browser storage, then used the platform's official relayer to execute unauthorized withdrawals totaling approximately $2.7 million across 737 wallets. No smart contract vulnerabilities were exploited; all 985 unauthorized transactions carried valid user signatures. The incident occurred on October 29 and was resolved within an hour after trading was halted, with Polymarket returning $3.9 million including compensation. This attack class matches the 2023 Ledger Connect Kit compromise, highlighting risks from third-party scripts in browser sessions. Polymarket has since committed to stricter CSP policies, script pinning, and sandboxing. The case underscores that browser-based sessions with full API privileges remain a critical trust boundary in crypto platforms.