Browser Extensions Are a Supply Chain Risk: Lessons from the Twitch OAuth Leak

When a browser add-on becomes the weakest linkBrowser extensions are convenient, but they also run with extensive privileges inside the browser. A rec...

When a browser add-on becomes the weakest link

Browser extensions are convenient, but they also run with extensive privileges inside the browser. A recent incident involving a Twitch viewing extension, Twitch Enhanced Viewer | JeetBot, shows how quickly that convenience can turn into a supply chain risk. The extension, available in both the Chrome Web Store and Mozilla Add-ons, was found to forward OAuth session tokens to proxy servers controlled by its operator. According to reports, credentials from around 31,000 users were exposed. The case is a reminder that even official extension catalogues do not guarantee safety.

Why OAuth tokens are not just harmless identifiers

OAuth tokens are bearer credentials: whoever holds them can act as the authenticated user. In the case of Twitch, that means reading and sending whispers, posting in chat, or changing account settings without knowing the password or passing two-factor authentication. The most concerning behaviour appeared in the v85.x branch, where the extension added the token as an &auth= query parameter during network-level redirects to operator-controlled proxy servers. Because the token travelled inside a URL, it could be stored in plain text in proxy logs, increasing the risk if those logs were accessed improperly or leaked. The forwarding applied to almost any channel a user opened, with a default exception list of ten channels. From version 85.8.4, the extension even allowed restrictions to be adjusted through a parameter, but that did not address the underlying exfiltration. Earlier v4.x versions had already sent tokens via POST to a set-token endpoint, with backup endpoints on deno.dev and deno.net.

What to do if you or your team used the extension

The fix is available in Firefox from version 85.8.7, which stops sending the token by changing how playlists are obtained. A Chrome patch was reportedly in preparation. However, updating or disabling the extension only stops the leak from that point onwards; it does not invalidate tokens that have already left. If you used the extension, take these steps:

Uninstall or disable Twitch Enhanced Viewer | JeetBot immediately.
On Firefox, update to at least version 85.8.7.
Close all active Twitch sessions from the account settings and sign in again to force session rotation.
Review recent activity, private messages, and chat actions for unauthorised use.

Extension hygiene for organisations

For managed teams and companies, this incident fits a familiar pattern: extensions that can intercept or redirect traffic from authenticated services. Basic hygiene includes inventorying installed extensions, blocking affected identifiers by policy (pnhhdhhcadcjfckjhpmjneldiegbojfb in Chrome and twitchenhancedviewer@example.com in Firefox), and prioritising allowlists in corporate browsers. Convenience should not have unlimited access to a session. In Spain, where GDPR and local data protection rules apply, a token leak can also trigger notification obligations if personal data is compromised.

Beyond the browser: protecting your own infrastructure

The same principle applies to servers. A single compromised credential can give an attacker a foothold, and many organisations run several machines with inconsistent protection. That is where a centralised approach helps. Abuse Shield from ALMC centralises server protection: it automatically blocks malicious IPs, manages fail2ban across multiple machines, and shares an IP reputation feed between all your servers. Instead of configuring each server separately, you get a single view and a coordinated response. For system administrators, hosting companies, and SMEs in Barcelona, Lleida, Tarragona, or Girona with their own servers, this reduces the window of opportunity for attackers and simplifies compliance.

Conclusion

Supply chain attacks are not limited to npm packages or third-party libraries; browser extensions are part of the same attack surface. The Twitch OAuth leak shows that token theft can happen quietly and at scale. Review your extensions, rotate sessions after any suspected exposure, and apply the same rigour to your servers. Centralised tools like Abuse Shield can help you keep malicious IPs at bay and maintain a consistent security posture across your infrastructure.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.