Twitch extension with 30K installs exposes users’ OAuth tokens

The Twitch Enhanced Viewer | JeetBot browser extension, with over 30,000 installs on Chrome and Firefox, captures users' Twitch OAuth tokens and sends them to proxy servers controlled by JeetBot, a commercial Russian-language streaming and chatbot service. The tokens are transmitted as cleartext in URL query parameters when video playlist requests are proxied, exposing them in server logs. Earlier versions of the extension openly admitted to collecting OAuth tokens, claiming it was necessary for HD streaming functionality. Security researchers recommend users uninstall the extension, revoke Twitch sessions, and re-authenticate to mitigate exposure.

AI-extracted · verify before operational use