Is MarketApp P2P safe?
MarketApp P2P is medium risk. The extension sends the Steam32 ID of every Steam profile you visit to Fastcup's GraphQL API (hasura.fastcup.net/v1/graphql). Fires on any Steam profile navigation, with the converted ID in the query variables, no opt-in or disclosure.…
Who publishes itmarket-app - no other listings under this identity, 4 shared hostnames
market-app - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Steam32 ID sent to Fastcup GraphQL endpoint on every profile visit
The extension sends the Steam32 ID of every Steam profile you visit to Fastcup's GraphQL API (hasura.fastcup.net/v1/graphql).
Fires on any Steam profile navigation, with the converted ID in the query variables, no opt-in or disclosure.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any Steam community profile page.
This fires on navigation to steamcommunity.com/profiles/<id> and steamcommunity.com/id/<username>.
The extension's background worker sends the viewed profile's Steam32 ID to a Fastcup GraphQL API.
The Steam64 ID is converted to Steam32 format and included in a GetUserStatsBySteamId query POSTed to hasura.fastcup.net/v1/graphql.
Returns Fastcup user statistics including nickname, rating, and match data for the queried Steam32 ID. Returns an empty users array if the profile has no Fastcup account.
- Content-Type
- application/json
{ "query": "query GetUserStatsBySteamId($steamId: bigint!, $gameModeId: Int!) { ... }", "variables": { "steamId": 124484118, "gameModeId": 27 }}FastcupService class in background.js
GraphQL client pointed at hasura.fastcup.net
js/background.jsclass FastcupService { constructor(injectCM) { this.graphQLClient = new UrqlClient({ url: "https://hasura.fastcup.net/v1/graphql", exchanges: [fetchExchange, cacheExchange] }); this.injectCM = injectCM; this.injectCM.addListener("fastcup-service-get-user-stats", this.getUserStats.bind(this)); }getUserStats — converts Steam64 to Steam32 and sends it
js/background.js async getUserStats(steam64Id) { try { const result = await this.graphQLClient.query( GET_USER_STATS_BY_STEAM_ID_QUERY, { steamId: SteamUtils.steam64ToSteam32(steam64Id), // converts 76561198084749846 -> 124484118 gameModeId: 27 } ); return result.data ?? (this.logger.log(result.error), null); } catch (e) { this.logger.error("FastcupService.getUserStats", e); return null; } }}- Viewed profile Steam32 ID124484118
The Steam32 ID of the account whose profile you opened, derived from the Steam64 ID. Fastcup can use this to track profiles you browse.
- Game mode ID27
A numeric code for the game mode context, always 27, hard-coded in the extension.
- hasura.fastcup.net
Fastcup's Hasura GraphQL API. Receives the Steam32 ID of every Steam profile visited via GetUserStatsBySteamId. A Russian CS2 tournament platform (cs2.fastcup.net).
Steam profile ID forwarded to Faceit API with hardcoded bearer token
The extension sends the Steam64 ID of every Steam profile you visit to the Faceit API (open.faceit.com), with a hardcoded bearer token.
Fires on any steamcommunity.com/profiles/* or /id/* navigation, with no opt-in or disclosure.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any Steam community profile page.
This fires on navigation to steamcommunity.com/profiles/<id> and steamcommunity.com/id/<username>, any public or private profile.
The extension's background worker fetches the viewed profile's stats from the Faceit API.
The Steam64 ID is sent as game_player_id to open.faceit.com/data/v4/players, authenticated with a bearer token hardcoded in the extension source.
Returns the Faceit player object for the viewed Steam profile, including Faceit nickname, skill level, and CS2 statistics. Returns null (404) if the profile has no Faceit account.
- Authorization
- Bearer b229f0c4-1ffb-4813-b19d-7dfb0f4c3a98
FaceitService class in background.js
Hardcoded base URL and bearer token
js/background.jsconst BASE_URL = "https://open.faceit.com/data/v4";const HARDCODED_TOKEN = "b229f0c4-1ffb-4813-b19d-7dfb0f4c3a98";const getAuthHeaders = () => HARDCODED_TOKEN ? { Authorization: `Bearer ${HARDCODED_TOKEN}` } : undefined;getPlayer — sends Steam64 ID on every profile view
js/background.jsasync getPlayer(steamId) { try { const url = `${BASE_URL}/players?game_player_id=${steamId}&game=cs2`; const response = await fetch(url, { headers: getAuthHeaders() }); if (!response.ok) { if (response.status === 404) return null; throw new Error(`Faceit API error: ${response.status}`); } return await response.json(); } catch (e) { this.logger.error("FaceitService.getPlayer", e); return null; }}- Viewed profile Steam64 ID76561198084749846
The unique numeric identifier of the Steam account whose profile page you opened. Faceit can use this to track which profiles you browse.
- Game filtercs2
The game context sent alongside the Steam ID, always 'cs2', hard-coded.
- open.faceit.com
Faceit's public data API. Receives the Steam64 ID of every profile page visited, authenticated with a token hardcoded in the extension. Faceit is operated by ESL Gaming GmbH.