⚠ Abuse-Tooling Advisory Classified 2026-07-08 · codelake triage
Confirmed abuse tooling. codelake independently classified this at 2026-07-08 (codelake triage) — 88狗 is a Steam-commerce / "accelerator" extension, not a catalogued supply-chain package — it is not in OSV or GHSA, and that database class does not fit it. codelake classified it independently from the live Chrome Web Store feed. We publish it as an abuse-tooling advisory (with an explicit privacy/session-risk caveat) and reported it to the Web Store — while correcting our own scanner’s over-read that it was outright malware..
Advisory · CLR-2026-2998

A Steam “accelerator” extension that reads your Steam session and proxies your Steam traffic

The Chrome extension 88狗 is a Chinese Steam market + “accelerator” (proxy) tool. To do its job it reads the user’s Steam session (the sessionid cookie and the public 17-digit SteamID out of steamLoginSecure), sends the session id and the user’s friend data to its own backend at a raw IP (http://120.55.185.135:62), automates Steam actions on the user’s behalf, sells services via Alipay, and routes Steam traffic through the operator’s proxy. It requests very broad permissions — <all_urls>, proxy, cookies, webRequestBlocking. We classify it as abuse tooling / greyware: it is not a covert credential stealer (the raw IP is its own declared backend, and the “remote code” flag is a local packaged script — both scanner over-reads we corrected) — but, unlike scoped automation extensions, it does carry a real privacy/session risk to the installer.

HighAbuse tooling / greywareReads Steam sessionRoutes traffic via operator proxyNot covert malwareReported to Chrome Web Store
Summary

88狗 is a Chrome extension (id cmpopiedmjniammgjfeioofnofgncnlb, v1.0.1) presented as a Steam market / trading + “accelerator” helper. Its content scripts run on steamcommunity.com / store.steampowered.com, but its manifest requests far broader capability: <all_urls>, proxy, cookies, webRequestBlocking, tabs.

From the background service worker it reads the user’s Steam cookies with chrome.cookies.getAll({domain:"steamcommunity.com"}), extracting the sessionid and the first 17 characters of steamLoginSecure — i.e. the public SteamID, not the secret auth token. It then fetches the user’s Steam friends list and POSTs the session id and friend data (friendCode, steamId, steamName) to its own backend at http://120.55.185.135:62/api/user/user. The same backend serves the tool’s pricing, ordering and Alipay payment endpoints (/api/user/price, /api/pay/*, /api/user/order/*).

For the “accelerator” function it installs a PAC-script proxy via chrome.proxy.settings.set, routing Steam traffic through the operator’s server. That places the operator on-path for the user’s Steam session: the full steamLoginSecure auth cookie travels in every proxied Steam request, even though the extension code itself only extracts the public SteamID.

Why this is Abuse/greyware, not covert Malware — and what we corrected

Our own extension scanner first flagged this as malicious (cookie-exfil + remote-code); we verified and downgraded that. The raw IP 120.55.185.135:62 is the tool’s own declared backend — every request to it is a first-party /api/user/… or Alipay /api/pay/… call, not covert C2. The remote-code flag is the extension injecting its own packaged script via chrome.runtime.getURL into the page — a local resource, not code fetched from the internet. And it takes only the public SteamID out of steamLoginSecure, not the secret token. So it is not a covert credential-stealing trojan.

It is, though, abuse tooling with a genuine privacy/session risk to the installer — a category above the scoped Auto-* automation extensions (CLR-2026-2996/2997). It automates Steam against Steam’s terms; it sends the user’s Steam sessionid and social graph to a raw-IP backend; and by proxying Steam traffic it puts the operator in a position to observe the full Steam session. Combined with the over-broad <all_urls> + proxy + cookies grant, that is a real reason to keep it off a machine you care about — and a Chrome Web Store acceptable-use matter.

Indicators & characteristics
EXT88狗 — Chrome Web Store id cmpopiedmjniammgjfeioofnofgncnlb, v1.0.1
PERMpermissions: storage, activeTab, webRequest, webRequestBlocking, , background, cookies, tabs, proxy · content scripts on steamcommunity.com / store.steampowered.com
SESSIONbackground_dog.js: chrome.cookies.getAll(domain=steamcommunity.com) → sessionid + steamLoginSecure.substring(0,17) (public SteamID); fetches friends list, POSTs {friendCode, steamId, steamName} + sessionid
INFRAOwn backend at raw IP http://120.55.185.135:62 — /api/user/user, /api/user/price, /api/pay/*, /api/user/order/*, /api/user/accelerate/url (Alipay payment flow)
PROXYchrome.proxy.settings.set with a PAC script routes Steam traffic through the operator — on-path for the user’s full Steam session (steamLoginSecure travels in proxied requests)
FPCorrected over-reads: raw IP = own declared backend (not C2); "remote-code" = chrome.runtime.getURL LOCAL bundled script; only the PUBLIC SteamID is extracted, not the secret token
Response & guidance
#ActionPriority
01 Treat it as greyware, not a scoped tool. Unlike an extension confined to one site, 88狗 reads your Steam session and routes your Steam traffic through its operator’s proxy. If you run it, do so only on a machine/account you are willing to expose to that operator. Warning
02 Remove it if you value your Steam account. The combination of your sessionid at a raw-IP backend plus operator-proxied Steam traffic is a session-hijack exposure, even though the extension itself does not exfiltrate the secret token. Recommended
03 Enterprise / managed Chrome: block-list the id. An extension requesting <all_urls> + proxy + cookies to run a Steam-commerce backend has no place in a managed fleet. Recommended
04 Reported to the Chrome Web Store for acceptable-use / abuse review. Out of scope for OSV / ossf-malicious-packages (not a supply-chain package attack); the store abuse channel is the correct route. Done

Classified independently by codelake Research · AI-assisted triage + deterministic structural analysis of the packed CRX (manifest, background service worker, cookie handling, request destinations, proxy configuration). Our own scanner first over-read this as malware; we verified and downgraded it — the raw IP is the tool’s own backend, the “remote code” is a local getURL script, and only the public SteamID is extracted. What remains, and what we publish, is a genuine privacy/session-risk abuse-tooling finding. Reported to the Chrome Web Store.

This is an abuse-tooling / greyware advisory, not a supply-chain-malware one, and not a covert-stealer one. No working payload or reproduction is published — the behaviour is described from structural analysis. The original artifact is preserved in the codelake archive and available to verified security researchers on request.