More than 30,000 installs — and a browser extension that forwards users’ Twitch OAuth session tokens to a third‑party bot service.
Twitch Enhanced Viewer | JeetBot extension: features and presence
The browser add-on marketed as Twitch Enhanced Viewer | JeetBot is available in the official Chrome Web Store and Firefox Add‑Ons store and advertises itself as a third‑party tool that can block ads, force 1080p (full HD) playback, bypass region restrictions, and enable channel‑point collection. At the time of publication the extension remained listed in both stores and had accumulated more than 30,000 installs.
Socket analysis: how tokens are captured and sent
Application security company Socket analyzed the extension and found that it captures the authorization header used by the Twitch web client, extracts the user OAuth token, and forwards those credentials through proxy servers. Socket describes the behavior in technical detail: “When the extension redirects Twitch’s video playlist request (to usher.ttvnw[.]net) through that proxy, it appends the token as an &auth= query parameter.” Because the token is placed in the URL query string, Socket notes, “it is written in cleartext into the proxy server’s request logs.”
Socket also reports that this redirection and token appending occurs for every Twitch channel a user watches, with one exception: a set of ten Russian‑language channels that are hardcoded into the extension’s code and do not trigger the same redirection.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildJeetBot, proxy logs, and past behavior
The proxy servers that receive the appended tokens are operated by JeetBot, identified in the report as a commercial Russian‑language streaming and chatbot service that offers tools for Twitch, Kick, and VK Live. In current versions of the extension the token is appended directly to redirected proxy requests as an auth= URL parameter, making the credentials easy to retrieve from ordinary proxy request logs.
Socket further highlights that earlier versions of the extension included “more explicit credential‑theft mechanisms.” The Firefox Add‑Ons description for the extension includes a machine‑translated disclaimer that acknowledges the prior behavior: “Previous versions of the extension transmit your OAuth‑twitch token to our server. This is necessary for the stream to run in 1080/1440p.”
By contrast, the data privacy disclosure for the Chrome variant states that its developer “disclosed that it will not collect or use your data,” a declaration that excludes selling user data except in approved cases and disallows transfer outside core functionality—or for lending‑related purposes.
BleepingComputer contacted JeetBot at the email address listed in the Chrome Web Store seeking comment, but had not received a response by the time of publication.
Recommended actions Socket and the report record
- Socket characterizes the extension as a security risk and advises users to remove it from their browsers.
- Socket recommends that affected users disconnect all sessions in Twitch and then re‑authenticate, which will invalidate any tokens that may have been forwarded.
- The analysis also contains a developer‑level warning: avoid routing requests that include authentication headers or tokens through third‑party servers.
What this means for Twitch users, browser‑extension developers, and JeetBot
Twitch users: Anyone running the extension should assume their session token may have been exposed. Socket’s advice — remove the extension, disconnect sessions in Twitch, and re‑authenticate — is meant to revoke any tokens copied to proxy logs.
Browser‑extension developers: The report underscores a practical rule repeated in the Socket findings: do not route requests that contain authentication headers or tokens through third‑party proxies. Placing tokens in URL query strings makes them persistent in logs and trivially retrievable by the operator of that proxy.
JeetBot as a service: The extension forwards tokens to proxy servers operated by JeetBot; earlier versions admitted token transmission in the Firefox listing. BleepingComputer’s unanswered request for comment leaves the vendor’s public response outstanding at publication.
The technical mechanics are straightforward and consequential: an OAuth session token captured by a seemingly helpful extension becomes a searchable string in ordinary proxy logs. Whether through intent or bad design, the result is the same — credentials exposed to the operator of those proxies. Socket’s remediation steps are simple and specific; the larger question left on the table is why a store‑listed extension that purports not to collect data was sending sensitive OAuth tokens into third‑party logs. For users who value account integrity, the immediate step is likewise simple: remove the extension and force token renewal.
Source: BleepingComputer — Twitch extension with 30K installs exposes users’ OAuth tokens
