Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: SkinSwipe

CRITICAL RISK

SkinSwipe

ID: jegmmnkojblmjglhgebkjaffabjflbab

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

1.0

Size

0.01 MB

Rating

5.0/5

Reviews

Users

159

Type

Extension

Updated

Apr 29, 2022

Publisher Contextual Analysis

Author: SkinSwipeView Profile
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

160

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Auto trading!

We have come up with a new way of trading on secondary platforms - "Direct trading". The buyer does not leave their trade URL or other information from the steam. The buyer does not have to accept the trade in steam, he gets into the inventory himself, and our sellers do not receive reports on steam as on other popular sites. Our bots are not blocked for spam trades, and your skins are guaranteed not to be lost. The browser extension is designed to automatically send a trade to steam when buying or selling a skin on the site skinswipe.ru . In order for the site to work with the browser extension, you need to reload the site page skinswipe.ru . The extension sends a trade via a request to steam at your partner's trade url opened from the website. All that remains for you is to wait for the other side to accept the trade.

User Growth

Showing data from Apr 20, 2022 to Apr 19, 2023

Versions

-26.46%(-59 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High1

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	4

Extension Version	Code Review Findings
1.0	4

Files with findings

1 distinct path — top paths by unique finding count:

js/content.js4

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/content.js (line 6)	The `window.message` listener performs no `event.origin` check, so any web page — not just skinswipe.ru — can post `ss_set_trade_data_req` with attacker-controlled trade data. Because the content script is injected on…	1.0
2	Credential Theft	critical	js/content.js (line 84)	On any steamcommunity.com page the extension silently retrieves stored trade data, builds a full trade offer POST using the victim's Steam session ID and cookies (`credentials: include`), submits it without any user c…	1.0
3	Credential Theft	high	js/content.js (line 35)	The function reads the entire rendered HTML of the Steam page (`document.all[0].outerHTML`) to extract the user's Steam session token via regex. The session ID is a per-session authentication credential; combined with…	1.0
4	Tracking	medium	js/content.js (line 1)	A sentinel DOM element is injected into the body of every page the user visits (content scripts match `https:///` and `http:///`), not only skinswipe or Steam domains. Any third-party website can query `document.g…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


steamcommunity.com	/tradeoffer/new/send	https://steamcommunity.com/tradeoffer/new/send
steamcommunity.com	/tradeoffer/new	https://steamcommunity.com/tradeoffer/new
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
localhost	/*	http://localhost:8080/*
skinswipe.ru	/*	https://skinswipe.ru/*
skinswipe.gg	/*	https://skinswipe.gg/*
steamcommunity.com	/*	https://steamcommunity.com/*
*	/*	https:///
*	/*	http:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

Работает отлично, это разработчик skinswipe. Качайте это новый способ трейдинга, абсолютно безопасный

Lid unknown_team·20 Apr 2022

Работает отлично, это разработчик skinswipe. Ка��айте это новый способ трейдинга, абсолютно безопасный

Lid unknown_team·20 Apr 2022

Работает отлично, это разработчик skinswipe. Ка��айте это новый сп��соб трейдинга, абсолютно безопасный

Lid unknown_team·20 Apr 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

SkinSwipe

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating