Is Нейромаркет - Реклама на Wildberries safe?

// Writes `name=value` as a cookie whose domain is forced to the eTLD+1// (e.g. "wildberries.ru"), NOT the current subdomain.function setCrossSubdomainCookie(name, value, days) {  const assign = name + "=" + escape(value) + ";";  const d = new Date();  d.setTime(d.getTime() + (days * 24 * 60 * 60 * 1000)); // 3-day expiry, passed in below  const expires = "expires=" + d.toUTCString() + ";";  const path = "path=/;";  // document.domain.match(/[^.]*\.[^.]*$/)[0] strips subdomains, leaving  // just "wildberries.ru" — this is what makes the cookie cross-subdomain.  const domain = "domain=" + (document.domain.match(/[^.]*\.[^.]*$/)[0]) + ";";  document.cookie = assign + expires + path + domain;}// Only runs on cmp.wildberries.ru / cmp-new.wildberries.ru: loads the// extension's own UI bundle into the page.if (CMP_LOCATIONS.some((pattern) => location.href.startsWith(pattern))) {  injectLocalScript("dist/bundle.js");}// Only runs on seller.wildberries.ru: reads the seller's Wildberries// access token straight out of localStorage and re-exposes it as a// domain-wide cookie. No validation of the token's shape, no scoping// check — any truthy value is copied.if (SELLER_LOCATIONS.some((pattern) => location.href.startsWith(pattern))) {  try {    const wbCaptchaKey = "wb-eu-passport-v2.access-token" // Wildberries' own localStorage key    const storageData = localStorage.getItem(wbCaptchaKey)    if (storageData) {      const bToken = btoa(storageData) // base64-encode, not encrypt      setCrossSubdomainCookie("neuromarket-auth-v3", bToken, 3) // 3-day cookie, domain-wide    }  } catch (e) {    console.log("Something wrong with auth token")  }}

// The extension's own UI (loaded on cmp.wildberries.ru) reads back the// three cookies it wrote from other pages and decodes them.let WB_TOKEN_RAW = getCookie("neuromarket-token") || null;let WB_CAPTCHA_RAW = getCookie("neuromarket-captcha-token") || null;let WB_AUTH_V3_RAW = getCookie("neuromarket-auth-v3") || null; // the seller access token, base64+URL-encodedlet WB_TOKEN = WB_TOKEN_RAW  ? Base64.decode(decodeURIComponent(WB_TOKEN_RAW))  : null;let WB_CAPTCHA = WB_CAPTCHA_RAW  ? Base64.decode(decodeURIComponent(WB_CAPTCHA_RAW))  : null;// Reverses the write side exactly: URL-decode, then base64-decode,// to recover the raw JWT access token.let WB_AUTH_V3 = WB_AUTH_V3_RAW  ? Base64.decode(decodeURIComponent(WB_AUTH_V3_RAW))  : null;

// Uses the token recovered from the cookie to call Wildberries' OWN// token-generation endpoint, creating a persistent, named API token// scoped to "contentanalytics" and "advert", read-only.createApiToken() {  try {    return new Promise((resolve, reject) => {      const onResponse = (response) => {        if (response?.result?.token?.accessToken) {          resolve(response.result.token.accessToken); // the newly minted API token        } else {          reject(false);        }      };      const options = {        headers: {          accept: "*/*",          "content-type": "application/json",          "sec-fetch-site": "same-origin",        },        referrer:          "https://seller.wildberries.ru/supplier-settings/access-to-api",        referrerPolicy: "strict-origin-when-cross-origin",        // Requests a read-only token named for the extension, scoped to        // content-analytics and advertising APIs.        body: '{"params":{"name":"[Нейромаркет] Реклама","scopes":["contentanalytics","advert"],"isReadOnly":true},"jsonrpc":"2.0","id":"json-rpc_70"}',        method: "POST",        mode: "cors",        credentials: "include",      }      // The token recovered from the domain-wide cookie authenticates      // this request to Wildberries' own API.      if (WB_AUTH_V3) {        options.headers['AuthorizeV3'] = WB_AUTH_V3      }      // Relayed through the background service worker rather than      // fetched directly from the page.      window.chrome.runtime.sendMessage(        NEUROMARKET_CHROME_ID,        {          type: "fetchJson",          url: "https://seller.wildberries.ru/ns/manage/api-tokens/api/tokens/generateToken",          options,        },        onResponse      );