Is Shop Deals safe?

#!/usr/bin/env node// Find hardcoded bearer credentials in an unpacked browser extension.// Usage: node find-bundled-bearer-tokens.js /path/to/unpacked-extensionconst fs = require('fs');const path = require('path');const root = process.argv[2];if (!root) {  console.error('usage: node find-bundled-bearer-tokens.js <unpacked-extension-dir>');  process.exit(1);}const BEARER = /Bearer\s+([A-Za-z0-9._\-]{16,})/g;const URL_RE = /https?:\/\/[^"'`\s\\]+/g;function walk(dir, out = []) {  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {    const full = path.join(dir, entry.name);    if (entry.isDirectory()) walk(full, out);    else if (/\.(js|mjs|html|json)$/i.test(entry.name)) out.push(full);  }  return out;}const findings = new Map();for (const file of walk(root)) {  const text = fs.readFileSync(file, 'utf8');  let m;  BEARER.lastIndex = 0;  while ((m = BEARER.exec(text)) !== null) {    const token = m[1];    // nearest URL literal before the header, which is normally the endpoint    const before = text.slice(Math.max(0, m.index - 400), m.index);    const urls = before.match(URL_RE) || [];    const endpoint = urls.length ? urls[urls.length - 1] : '(endpoint not resolved)';    const key = token + '|' + path.relative(root, file) + '|' + endpoint;    findings.set(key, { token, file: path.relative(root, file), endpoint });  }}if (findings.size === 0) {  console.log('No hardcoded bearer tokens found.');  process.exit(0);}const byToken = new Map();for (const f of findings.values()) {  if (!byToken.has(f.token)) byToken.set(f.token, []);  byToken.get(f.token).push(f);}for (const [token, uses] of byToken) {  const masked = token.slice(0, 8) + '...' + '(' + token.length + ' chars)';  console.log('\nToken ' + masked + ' shipped in the bundle, used ' + uses.length + ' time(s):');  for (const u of uses) {    console.log('  ' + u.file + '  ->  ' + u.endpoint);  }  if (uses.length > 1) {    console.log('  NOTE: one credential reused across multiple call sites.');  }}