Is PhantomBuster safe?

export async function getCurrentOrgIdFromCookies() {	const cookies = await getCookies()	const baseDomain = new URL(import.meta.env.VITE_PHANTOMBUSTER_BASE_URL).hostname	const currentOrg = findCookie(cookies, CURRENT_ORG_ID_COOKIE, baseDomain)	return currentOrg?.value ?? ""}export const apiV2Client = createClient<paths>({	baseUrl: new URL("/api/v2", import.meta.env.VITE_PHANTOMBUSTER_API_URL).toString(),	headers: {		"x-phantombuster-browser-extension": getBrowserName(),		"x-phantombuster-browser-extension-version": getExtensionVersion(),	},})const middleware: Middleware = {	async onRequest({ request }) {		const orgIdHeader = "X-Phantombuster-Org"		const currentOrgId = await getCurrentOrgIdFromCookies()		const hasOrgIdHeader = request.headers.has(orgIdHeader)		const shouldReplaceOrgIdHeader = !hasOrgIdHeader && currentOrgId		if (shouldReplaceOrgIdHeader) {			request.headers.set(orgIdHeader, currentOrgId)		}		if (import.meta.env.MODE === "development") {			// eslint-disable-next-line no-console			console.info(`[ApiPbV2Client] Making ${request.method} request to: ${request.url}`)			// eslint-disable-next-line no-console			console.info(`[ApiPbV2Client] Headers:`, Object.fromEntries(request.headers))		}		return request	},}apiV2Client.use(middleware)/** Upsert a lead */export const saveLead = async (body: SaveLeadsPayload, init?: RequestInit) =>	apiV2Client.POST("/org-storage/leads/save", {		body,		signal: init?.signal,	})export function useMutationSaveLead() {	return useMutation({		mutationKey: ["/org-storage/leads/save"],		mutationFn: saveLead,		onError() {			toast.error("We couldn’t save the profile. Try again in a bit.", {				dismissible: true,			})		},	})}export const mapProfileToLead = (profile: Profile): Partial<SaveLeadsPayload> => ({	firstName: profile.firstName,	lastName: profile.lastName,	linkedinJobLocation: profile.location?.name,	linkedinHeadline: profile.headline,	location: profile.location?.name,	companyName: profile.jobExperiences?.[0]?.name,	linkedinCompanyUrl: profile.jobExperiences?.[0]?.linkedinUrl,	linkedinDescription: profile.summary,	previousCompanyName: profile.jobExperiences?.[1]?.name,	linkedinJobTitle: profile.jobExperiences?.[0]?.jobTitle,	personalEmails: profile.personalEmail ? [profile.personalEmail] : [],	professionalEmails: profile.professionalEmail ? [profile.professionalEmail] : [],	phoneNumbers: profile.phoneNumbers ? [...profile.phoneNumbers] : [],})/** Save current Linkedin profile to the leads database */export const useCreateLeadFromCurrentTab = () => {	const { slug } = useParams<{ slug: string }>()	const { mutateAsync: saveLead, isIdle, error } = useMutationSaveLead()	const { data: tab } = useSuspenseTab()	const { profile } = useSuspenseProfileAndCompany(slug ?? "")	const createLead = async () => {		return saveLead({			linkedinProfileUrl: resolveMeLinkedinSlugToFullUrl({				tabUrl: extractLinkedInSlugUrl(tab?.url),				profileSlug: profile?.slug,			}),			...mapProfileToLead(profile),		})	}	return {		createLead,		createLeadIdle: isIdle,		createLeadError: error,	}}

export async function discoverProfileEmailAndPhone(	orgName: string,	body: { payload: EmailDiscoveryPayload | EmailDiscoveryPayload[] },	init?: RequestInit,) {	const res = await apiV1Client.POST<EmailDiscoveryResponse>("/discover-email", {		body: Object(body),		headers: {			"X-Phantombuster-Org-Name": orgName,		},		signal: init?.signal,	})	if (res.err) {		console.error(res.err)		throw res.err	}	return res.data.data}/** * Unfortunatly the v1 api does not have type definition so we will use it without openapi-fetch */export const apiV1Client = {	async request<T>(		method: string,		endpoint: `/${string}`,		options: RequestInit = {},	): Promise<		| { data: T; err?: never }		| {				err: Error				data?: never		  }	> {		options.headers = {			...options.headers,			"Content-Type": "application/json",			"x-phantombuster-browser-extension": getBrowserName(),			"x-phantombuster-browser-extension-version": getExtensionVersion(),		}		options.method = method		if (options.body) {			options.body = JSON.stringify(options.body)		}		return fetch(new URL(`/api/v1${endpoint}`, import.meta.env.VITE_PHANTOMBUSTER_API_URL), options)			.then(async (res) => {				if (!res.ok) {					throw new Error(await res.text())				}				return { data: (await res.json()) as T }			})			.catch((err: Error) => {				console.error(err)				return { err }			})	},	GET<T>(endpoint: `/${string}`) {		return this.request<T>("GET", endpoint)	},	POST<T>(endpoint: `/${string}`, options: RequestInit) {		return this.request<T>("POST", endpoint, options)	},	PUT<T>(endpoint: `/${string}`, options: RequestInit) {		return this.request<T>("PUT", endpoint, options)	},	DELETE<T>(endpoint: `/${string}`) {		return this.request<T>("DELETE", endpoint)	},	PATCH<T>(endpoint: `/${string}`, options: RequestInit) {		return this.request<T>("PATCH", endpoint, options)export function useEmailAndPhoneDiscovery({ orgName, profile }: { orgName: string; profile: Profile }) {	const { data, error, isPending, mutateAsync } = useMutationDiscoverProfileEmailAndPhone(profile.slug ?? "")	const errorBoundary = useErrorBoundary()	const discoverMutationKey = [DISCOVER_PROFILE_EMAIL_AND_PHONE_KEY, profile.slug]	const [mutationStatus] = useMutationState({		filters: { mutationKey: discoverMutationKey },		select: (mutation) => mutation.state.status,	})	async function fetchContactInfo() {		errorBoundary.resetBoundary()		const company = findProfileMainCompany(profile)		try {			await mutateAsync({				orgName,				payload: {					first_name: profile.firstName,					last_name: profile.lastName,					company: company?.name,					linkedin: constructLinkedinProfileUrlFromPublicIdentifier(profile.slug),					company_linkedin: company?.linkedinUrl,				},			})		} catch (err) {			errorBoundary.showBoundary(err)		}	}	return {		data,		error,		isLoading: isPending || mutationStatus === "pending",		fetchContactInfo,	}}

export const findLinkedInCsrfToken = (cookies: Cookies.Cookie[]) => {	// The CSRF token is required to make authenticated calls to the LinkedIn API and is stored in the "JSESSIONID" cookie for some reason	// The JSESSIONID cookie takes the following form: "ajax:<random number>"	// The extra quotes need to be removed before it can be used	const csrfToken = cookies		.find((cookie) => cookie.domain === ".www.linkedin.com" && cookie.name === "JSESSIONID")		?.value?.replace(/"/g, "")	return csrfToken ?? null}async function sendVoyagerRequest<TResponse>(endpoint: `/${string}`, csrfToken: string): Promise<TResponse> {	try {		const response = await fetch(`https://www.linkedin.com/voyager/api${endpoint}`, {			headers: {				"csrf-token": csrfToken,				"accept-language": "en-US,en;q=0.9,fr-FR;q=0.8,fr;q=0.7",				"sec-ch-ua": '"Chromium";v="116", "Not)A;Brand";v="24", "Google Chrome";v="116"',				"sec-ch-ua-mobile": "?0",				"sec-ch-ua-platform": '"Windows"',				"sec-fetch-dest": "empty",				"sec-fetch-mode": "cors",				"sec-fetch-site": "same-origin",				"x-li-lang": "en_US",				"x-li-track":					'{"clientVersion":"0.2.*","osName":"web","timezoneOffset":2,"deviceFormFactor":"DESKTOP","mpName":"settings-web","displayDensity":1}',				"x-restli-protocol-version": "2.0.0",			},			referrer: "https://www.linkedin.com/feed/",			referrerPolicy: "strict-origin-when-cross-origin",			body: null,			method: "GET",			mode: "cors",			credentials: "include",		})		if (!response.ok) {			const text = await response.text()			throw new Error(`LinkedIn API error (${response.status}): ${text}`)		}		return response.json() as TResponse	} catch (err) {		throw err	}}export async function handleVoyagerRequest(request: VoyagerRequest): Promise<VoyagerResponse> {	try {		const browserCookies = await browser.cookies.getAll({})		const csrfToken = findLinkedInCsrfToken(browserCookies)		if (!csrfToken) {			throw new Error("CSRF token not found")		}		let data: unknown		switch (request.type) {			case "profile":				data = await sendVoyagerRequest<VoyagerProfileResponse>(					`/identity/dash/profiles?q=memberIdentity&memberIdentity=${request.slug}&decorationId=com.linkedin.voyager.dash.deco.identity.profile.FullProfileWithEntities-35`,					csrfToken,				)				break			case "company":				data = await sendVoyagerRequest<VoyagerCompanyResponse>(					`/organization/companies?q=universalName&universalName=${request.slug}&decorationId=com.linkedin.voyager.deco.organization.web.WebFullCompanyMain-12`,					csrfToken,				)				break			case "identityDashProfiles":				data = await sendVoyagerRequest<IVoyagerDashProfileResponse>(					`/graphql?variables=(memberIdentity:${request.slug})&queryId=voyagerIdentityDashProfiles.c7452e58fa37646d09dae4920fc5b4b9`,					csrfToken,				)				break			case "search":				data = await sendVoyagerRequest<VoyagerSearchResultResponse>(`/${request.slug}`, csrfToken)				break		}		return {			voyagerResponse: {				type: request.type,				data,			},		}	} catch (error) {		return {			voyagerResponse: {				type: request.type,				data: null,				error: error instanceof Error ? error.message : "Unknown error",			},		}	}}browser.runtime.onMessage.addListener(async (msg: FromContentScriptRuntimeMessages, sender: Runtime.MessageSender) => {	try {		if (msg.voyagerRequest) {			const response = await handleVoyagerRequest(msg.voyagerRequest)			if (sender.tab?.id) {				await sendMessage(sender.tab.id, response)			}			return response		}		if (msg.action === "update_tab" && msg.newUrl) {			await updateCurrentTabUrl(msg.newUrl)		}		if (msg.newTab && sender.tab) {			await newTab(msg.newTab.websiteName, msg.newTab.url, sender.tab)		} else if (msg.getCookies && sender.tab && msg.getCookies.websiteName !== "X") {			await getCookies(msg.getCookies.websiteName, sender.tab)		} else if (msg.getCookies && sender.tab && msg.getCookies.websiteName === "X") {			if (!isChromium) {				// We only execute the permission request in Chrome. Firefox has the required permissions to retrieve the session cookie from x.com				// The permissions API is not working on Firefox (bug -> https://bugzilla.mozilla.org/show_bug.cgi?id=1392624)				await getCookies(msg.getCookies.websiteName, sender.tab)				return			}			const permissionsGranted = await browser.permissions.request({				origins: ["*://*.x.com/*"],			})			if (permissionsGranted) {				await getCookies(msg.getCookies.websiteName, sender.tab)			} else {				await sendNotification(					"PhantomBuster",					"You must approve new permissions for x.com to retrieve your Twitter session cookie.",				)			}		} else if (msg.notif) {			await sendNotification(msg.notif.title || "PhantomBuster", msg.notif.message)		} else if (msg.restartMe && sender.tab && sender.tab.id) {			await sendMessage(sender.tab.id, { restart: true })		} else if (msg.userInfo && sender.tab?.id) {			await handleUserInfoRequest(sender.tab.id, msg.userInfo)		}	} catch (error) {		handleError(error)	}})