Is Faceit Stats by Eloking safe?
Faceit Stats by Eloking sends Steam profile lookups to FACEIT with a bundled API bearer token.
When you view a Steam profile, the extension looks up the profile's CS2 FACEIT data through open.faceit.com. Its background service worker adds a hardcoded FACEIT API bearer token to those requests, so the credential is shipped inside every installed copy of the extension.
Who publishes iteloking - no other listings under this identity
eloking - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Faceit Stats by Eloking ships one hardcoded FACEIT API token to every install
Faceit Stats by Eloking embeds one FACEIT API bearer token in its background script, so every install shares the same credential.
The token returns live FACEIT profile data; the same request without it returns HTTP 403.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You open a Steam Community profile page.
Any URL matching steamcommunity.com/id/* or /profiles/*.
The extension's background script requests your FACEIT profile using a bearer token hardcoded in its own source code.
The same token value ships inside every copy of the extension; it is not tied to your account.
HTTP 200 with the player's FACEIT profile (player ID, nickname, CS2 elo). The identical request with the Authorization header removed returns HTTP 403 'not authorized'.
- Accept
- application/json
- User-Agent
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- Authorization
- Bearer <redacted>
- Authorization headerBearer <redacted>
A single fixed API credential is sent on every request, identical across every install of the extension.
- Steam ID76561198034202275
Your SteamID64, read from the profile page you're viewing, is used to build the FACEIT lookup.
- open.faceit.com
FACEIT's public player-stats API. Receives the SteamID64 from every profile page you view, authenticated with the extension's shared bearer token.
Extracts the bearer token from a local unpacked copy of the extension's background.js, then shows FACEIT's API accepting it and rejecting the same request without it.
- Python 3.8+
- A local unpacked copy of the extension
#!/usr/bin/env python3"""Proves the FACEIT bearer token hardcoded in this extension's background.jsis a live, working API credential shared by every install.The script never hardcodes the token itself; it extracts whatever value ispresent in the background.js you point it at."""import reimport sysimport urllib.requestimport urllib.errorPLAYER_URL = ( "https://open.faceit.com/data/v4/players" "?game=cs2&game_player_id=76561198034202275")def extract_token(path): with open(path, "r", encoding="utf-8") as f: src = f.read() match = re.search(r"Bearer\s+([0-9a-fA-F-]{36})", src) if not match: raise SystemExit(f"No bearer token found in {path}") return match.group(1)def fetch(url, token=None): headers = {"Accept": "application/json"} if token: headers["Authorization"] = f"Bearer {token}" req = urllib.request.Request(url, headers=headers) try: with urllib.request.urlopen(req) as resp: return resp.status except urllib.error.HTTPError as e: return e.codeif __name__ == "__main__": bg_path = sys.argv[1] if len(sys.argv) > 1 else "background.js" token = extract_token(bg_path) status_with = fetch(PLAYER_URL, token) status_without = fetch(PLAYER_URL, None) print(f"WITH extracted token: HTTP {status_with}") print(f"WITHOUT any token: HTTP {status_without}")- 1Unpack the extension (Developer mode, or unzip the .crx).
- 2Find scripts/background.js in it.
- 3Run: python3 faceit_token_poc.py /path/to/background.js.
- 4Compare the two status lines.
What it can do
Permissions this extension asks for, as declared in version 5.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.faceit.com
https://api.faceit.com/*
Read and change your data on open.faceit.com
https://open.faceit.com/*
Where it sends data
Destinations our analysis observed Faceit Stats by Eloking contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- open.faceit.com
Faceit Stats by Eloking sends data to open.faceit.com. 4 other extensions we have analysed send data here.