Is Memo Token Login discord safe?

Memo Token Login discord writes any discordtoken URL parameter it sees on discord.com into local storage as the active session.

This extension lets a user log into Discord by pasting a token into its popup, which opens discord.com with that token in a URL parameter. Its content script runs on every discord.com page load, clears existing cookies, and copies whatever value is in the discordtoken parameter into local storage as the active session token, then redirects to the inbox. Because the script does not check that the navigation came from its own popup, visiting any discord.com link carrying a crafted discordtoken parameter is enough to replace a user's logged-in session with an attacker-chosen one.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.