Is Нейромаркет - Реклама на Wildberries safe?

// Writes `name=value` as a cookie whose domain is forced to the eTLD+1
// (e.g. "wildberries.ru"), NOT the current subdomain.
function setCrossSubdomainCookie(name, value, days) {
  const assign = name + "=" + escape(value) + ";";
  const d = new Date();
  d.setTime(d.getTime() + (days * 24 * 60 * 60 * 1000)); // 3-day expiry, passed in below
  const expires = "expires=" + d.toUTCString() + ";";
  const path = "path=/;";
  // document.domain.match(/[^.]*\.[^.]*$/)[0] strips subdomains, leaving
  // just "wildberries.ru" — this is what makes the cookie cross-subdomain.
  const domain = "domain=" + (document.domain.match(/[^.]*\.[^.]*$/)[0]) + ";";
  document.cookie = assign + expires + path + domain;
}

// Only runs on cmp.wildberries.ru / cmp-new.wildberries.ru: loads the
// extension's own UI bundle into the page.
if (CMP_LOCATIONS.some((pattern) => location.href.startsWith(pattern))) {
  injectLocalScript("dist/bundle.js");
}

// Only runs on seller.wildberries.ru: reads the seller's Wildberries
// access token straight out of localStorage and re-exposes it as a
// domain-wide cookie. No validation of the token's shape, no scoping
// check — any truthy value is copied.
if (SELLER_LOCATIONS.some((pattern) => location.href.startsWith(pattern))) {
  try {
    const wbCaptchaKey = "wb-eu-passport-v2.access-token" // Wildberries' own localStorage key
    const storageData = localStorage.getItem(wbCaptchaKey)

    if (storageData) {
      const bToken = btoa(storageData) // base64-encode, not encrypt
      setCrossSubdomainCookie("neuromarket-auth-v3", bToken, 3) // 3-day cookie, domain-wide
    }
  } catch (e) {
    console.log("Something wrong with auth token")
  }
}

// The extension's own UI (loaded on cmp.wildberries.ru) reads back the
// three cookies it wrote from other pages and decodes them.
let WB_TOKEN_RAW = getCookie("neuromarket-token") || null;
let WB_CAPTCHA_RAW = getCookie("neuromarket-captcha-token") || null;
let WB_AUTH_V3_RAW = getCookie("neuromarket-auth-v3") || null; // the seller access token, base64+URL-encoded

let WB_TOKEN = WB_TOKEN_RAW
  ? Base64.decode(decodeURIComponent(WB_TOKEN_RAW))
  : null;

let WB_CAPTCHA = WB_CAPTCHA_RAW
  ? Base64.decode(decodeURIComponent(WB_CAPTCHA_RAW))
  : null;

// Reverses the write side exactly: URL-decode, then base64-decode,
// to recover the raw JWT access token.
let WB_AUTH_V3 = WB_AUTH_V3_RAW
  ? Base64.decode(decodeURIComponent(WB_AUTH_V3_RAW))
  : null;

// Uses the token recovered from the cookie to call Wildberries' OWN
// token-generation endpoint, creating a persistent, named API token
// scoped to "contentanalytics" and "advert", read-only.
createApiToken() {
  try {
    return new Promise((resolve, reject) => {
      const onResponse = (response) => {
        if (response?.result?.token?.accessToken) {
          resolve(response.result.token.accessToken); // the newly minted API token
        } else {
          reject(false);
        }
      };
      const options = {
        headers: {
          accept: "*/*",
          "content-type": "application/json",
          "sec-fetch-site": "same-origin",
        },
        referrer:
          "https://seller.wildberries.ru/supplier-settings/access-to-api",
        referrerPolicy: "strict-origin-when-cross-origin",
        // Requests a read-only token named for the extension, scoped to
        // content-analytics and advertising APIs.
        body: '{"params":{"name":"[Нейромаркет] Реклама","scopes":["contentanalytics","advert"],"isReadOnly":true},"jsonrpc":"2.0","id":"json-rpc_70"}',
        method: "POST",
        mode: "cors",
        credentials: "include",
      }

      // The token recovered from the domain-wide cookie authenticates
      // this request to Wildberries' own API.
      if (WB_AUTH_V3) {
        options.headers['AuthorizeV3'] = WB_AUTH_V3
      }

      // Relayed through the background service worker rather than
      // fetched directly from the page.
      window.chrome.runtime.sendMessage(
        NEUROMARKET_CHROME_ID,
        {
          type: "fetchJson",
          url: "https://seller.wildberries.ru/ns/manage/api-tokens/api/tokens/generateToken",
          options,
        },
        onResponse
      );