Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, distributed through the official Chrome Web Store and Mozilla Add-ons, forwarded OAuth session tokens to proxies under the control of its operator. With these tokens, an attacker can hijack accounts without needing the password or bypassing two-factor authentication, allowing actions ranging from reading and sending whispers to writing in chat and altering linked account settings.
The tokens function as bearer credentials: anyone in possession can impersonate the user on Twitch. The most critical behavior appeared in the v85.x branch, which added the token as the &auth= query parameter during network-level redirects to operator-controlled proxy servers. Because the token traveled inside URLs, it could remain in clear text inside proxy logs, greatly increasing exposure if those logs were accessed improperly or leaked.
The forwarding occurred for nearly every channel a user opened, with the sole exception of a hardcoded list of ten channels. Starting with version 85.8.4, the extension also exposed a Channels with restrictions setting that gave an appearance of control while the underlying exfiltration continued. Earlier v4.x releases had already sent tokens via POST to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net.
Remediation and Recommendations
The corrected version for Firefox, 85.8.7, eliminates token transmission by changing the playlist retrieval method. An equivalent Chrome update is being prepared. Updating or disabling the extension stops further leakage but does not invalidate tokens already sent. Users should therefore uninstall or disable Twitch Enhanced Viewer | JeetBot immediately, close all active Twitch sessions from account settings, and re-authenticate to force session rotation. Reviewing recent activity, private messages, and chat actions is also recommended.
In managed environments the incident highlights the classic supply-chain risk posed by extensions that can intercept or redirect traffic for authenticated services. Basic hygiene includes maintaining an inventory of installed extensions, blocking the affected identifiers pnhhdhhcadcjfckjhpmjneldiegbojfb in Chrome and twitchenhancedviewer@example.com in Firefox, and enforcing allow-lists on corporate browsers.
Related articles
CodeScoring Launches CodeScoring.Save Artifact Repository for Secure Enterprise Development
CodeScoring has introduced its own artifact storage solution called CodeScoring.Save, designed to handle packages, libraries, container images, and other software components used in development. The product targets corporate users of any size seeking a predictable and resilient repository that integrates security checks directly into storage and distribution workflows. Built in Go for modern Kubernetes environments, Save supports multiple package formats including Maven, npm, NuGet, PyPI, Go Modules, Docker/OCI, DEB, and RPM while providing proxy access to external repositories. It features role-based access, auditing, independent scaling of compute and storage layers, and native integration with CodeScoring.OSA to surface vulnerability data inside the repository itself. The company positions Save as a standalone local deployment option that can operate independently or alongside its existing OSA Proxy module to block malicious components at the repository level. Future plans include support for AI models as artifacts, starting with storage and distribution for ecosystems such as Hugging Face, along with certification for Russian secure development requirements.
WordPress to Automatically Block High-Risk Plugin Updates Before Distribution
WordPress is introducing an automated security screening process for every new plugin release before it reaches millions of sites through the WordPress.org API. Updates flagged with high risk will be blocked from automatic installation, giving developers time to address issues. Previously, only initial plugin submissions were reviewed, while subsequent versions could introduce vulnerabilities, backdoors, or malicious ownership changes without checks. Each release now undergoes a six-hour delay under the Protect The Shire initiative, where multiple AI models and Jetpack Scan analyze changes to produce a combined risk score. High-risk updates are withheld from auto-updates, and developers receive detailed reports. The system has already proven effective by catching a backdoor in a plugin with around 20,000 active installations on July 28, preventing distribution after Wordfence notification. Developers can fix problems and resubmit, or appeal results, though fixing is usually faster than manual review.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue became especially severe in the v85.x branch, where tokens were appended as the &auth= query parameter during network redirects to the operator’s proxy servers, exposing them in clear text within proxy logs. Earlier versions had already transmitted tokens via POST requests to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net. A fix is available in Firefox starting with version 85.8.7, which stops token exfiltration by changing the playlist retrieval method, while a corresponding Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Widespread AI Outage Exposes Fragile Cloud Dependencies Behind ChatGPT, Claude and Grok
On September 3, major AI services including ChatGPT, Claude, Grok, Copilot and Gemini suffered a simultaneous outage lasting nearly four hours. The incident began around 9:30 a.m. ET with ChatGPT and rapidly spread, generating over 12,000 reports on Downdetector within twenty minutes. Industry analysis points to underlying cloud infrastructure rather than the models themselves, with Microsoft Azure and Cloudflare identified as the most likely points of failure. Developers relying on tools such as Cursor experienced immediate loss of code completion and intelligent assistance, forcing manual workflows. The event highlighted single points of failure created by heavy concentration of AI workloads on a small number of cloud providers. Security professionals are urged to map AI supply chains, prepare fallback procedures, monitor infrastructure status pages and adopt multi-vendor routing for critical operations.