WebAssembly is traditionally thought of as a mechanism to run compiled code inside your browser, but rarely as a mechanism to run full application code directly on host. We hacked up the Wazero implementation of WebAssembly and modified it to transform existing GoLang security tooling into analyst resistant malware. This isn't just a toy implementation either, we've implemented every major host API such that we can compile a full Sliver binary to run on MacOS or Windows.

This blog post covers the implementation details behind our Go->WASM compilation process and sets up our final blog post (coming next week) where we'll discuss a similar C#->WASM compilation pipeline. The tooling described in this blog post will be open sourced next week. Will be happy to answer any questions about this in the comments!

The -s flag in /sbin/ping has a maxpayload bounds check. -G sweepmax doesn't. An #ifndef __APPLE__ block removed the original uid guard without adding an equivalent check, so the fill loop walks past the end of the 65,535-byte outpackhdr[] BSS global and into adjacent globals.

The write is byte-precise and deterministic: byte at offset N gets value (N-1) % 256, fully controlled by -G.

Empirically confirmed on macOS 26.4.1 arm64e:

- sweepmax=65637: overwrites the static int s socket fd at BSS+128 with 0x63. Every subsequent setsockopt() returns EBADF. Exit 71.

- sweepmax=65636: runs clean. Binary-searchable threshold, invariant across runs.

At higher sweepmax values the loop reaches pointer-type globals (*outpack, *hostname, *shostname). On x86_64 that's a write-what-where bounded by the sequential value constraint. On arm64e, PAC blocks code-pointer hijack; state corruption is still demonstrable.

ping isn't setuid on macOS 11+, so no direct priv-esc. Local only.

Fix is one line — symmetric maxpayload check matching what -s already does.

Apple confirmed 16 April 2026, fix scheduled Fall 2026. Source is open: github.com/apple-oss-distributions/network_cmds

Full write-up with memory dump evidence:

https://stuart-thomas.com/research/ping-sweepmax-bss/

Summary: I’m disclosing a full-chain CVSS 10.0 RCE affecting Microsoft Semantic Kernel (.NET v1.74) and the new Agent Framework 1.0.

The Timeline & Conflict: > * March 24: Initial disclosure sent to MSRC with PoC.

• April 8: MSRC closed the case as "Developer Error / Configuration Issue."
• The Reality: Despite the rejection, Microsoft silently merged mitigations in PRs #13683 and #13702 without assigning a CVE. This results in a "False Green" for enterprise SCA tools (Snyk/Checkmarx/Dependabot) while the bypasses remain functional.

Technical Scope:

• Architectural Trust Gap (CWE-1039): Auto-invocation logic treats non-deterministic LLM output as a high-privilege system coordinator without a sandbox boundary.
• 6 Day-Zero Bypasses: Discovery of Type Confusion and Unicode homoglyphs that defeat the "hardened" baseline in the April 2026 releases.
• Versioning: Persistence confirmed from .NET v1.7x through the Agent Framework 1.0 re-baseline.

Full paper, .cast exploit recordings, and a production-ready C# remediation filter are available at the link.

Perforce is source control software used in games, entertainment, and a few engineering sectors. It's particularly useful when large binary assets need to be stored alongside source code. It handles binary assets much better than Git, IMO. However, its one weakness is its terrible security defaults. You will die a bit inside when you see the out-of-the-box behaviour: "Don't have an account? Let me make one for you!" and "Oh, you didn't know by default there is a hidden, read-only 'remote' user that allows read access to everything? Oops!"

I scanned 6,122 public Perforce servers last year. 72% were exposing source code, 21% had passwordless accounts, and 4% had unprotected superusers (which allow RCE). The vendor patched the largest issue, but a significant portion are still vulnerable.

Full write-up and methodology: https://morganrobertson.net/p4wned/

Tools repo, including Nuclei templates to scan your infra: https://github.com/flyingllama87/p4wned

Hardening is a pain, but here it is summed up: p4 configure set security=4 # disables the built-in 'remote' user + strong auth p4 configure set dm.user.noautocreate=2 # kills auto-signup p4 configure set dm.user.setinitialpasswd=0 # users cannot self-set first password p4 configure set dm.user.resetpassword=1 # force password reset flow p4 configure set dm.info.hide=1 # hide server license, internal IP, root path p4 configure set run.users.authorize=1 # user listing requires auth p4 configure set dm.user.hideinvalid=1 # no hints on bad login p4 configure set dm.keys.hide=2 # hide stored key/value pairs from non-admins p4 configure set server.rolechecks=1 # prevent P4AUTH misuse

Happy to answer any questions on the research!

TL;DR: Our research team reported two credential findings to official bug bounty programs. A Slack Bot Token exposed for 3 years in a public GitHub repo, and an Asana Admin API Key exposed for 2 years in a public GitHub repo. Both came back "Out of scope." Both organizations actively used the affected systems, revoked the keys, and ran broader internal reviews based on the disclosures. Official classification stayed "Out of scope" anyway. We wrote up why this keeps happening and proposed a 6-axis scoring framework to address the post-discovery evaluation gap that OWASP API Top 10, CWE-798, NIST SP 800-53, and NIST CSF 2.0 don't cover (they're all prevention frameworks). Some of what the writeup covers:

Why credential exposure doesn't fit the vulnerability-exploit-impact model bug bounty programs were built around. A leaked API key isn't a flaw waiting to be exploited. It's access. The usual severity calculus breaks. Six axes that actually matter for post-discovery credential severity: Privilege Scope, Cumulative Risk Duration, Blast Radius, Exposure Accessibility, Data Sensitivity, Lateral Movement Potential. Scored 1 to 5 each, mapped to severity tiers. Concrete scoring of the two cases: Slack Bot Token 26/30 (Critical), Asana Admin Key 24/30 (Critical). A counter-example: Starbucks bug bounty's handling of a leaked JumpCloud API key (HackerOne #716292, 2019). Same finding class. Classified under CWE-798, scored CVSS 9.7, triaged, paid, and publicly disclosed. Proves it's a classification policy problem, not a technical one. Why AI-assisted code generation (especially by non-developers now shipping prototypes directly) is about to accelerate the problem.

Open to critique on the framework. The six axes are a starting point for discussion, not a finished standard. Particularly curious whether the community has hit the same "Out of scope" wall for SaaS credentials or keys inherited from M&A situations.

I've written a scanner for XPI browser extension files which analyzes a browser extension for malicious content. It will print everything that is suspicious or could be used for something malicious so that you will know if and where you can begin with your malware analysis. Example output of a Firefox malware extension (which is live on firefox extensions store)

browser-xpi-malware-scanner.py - Python script for XPI malware scanning on github.com

I have written the above script, and I ran it against 15~ random extensions from the store with less than 10K downloads, and it didn't take me more than 10 minutes to find the malware extension above.

I've also completely reverse engineered the extension to find out exactly what it does, and written an article about it where I walk you through the code and exploitation process steb-by-step, showing all the techniques used to hide from the verification processes in the extension store, breaking out of the sandbox and stealing credentials with a full Command and control server controlling it.

The malware code is very sophisticated. The payload never touches the DOM. It never appears in network DevTools as a suspicious request. It is stored in extension localStorage where casual inspection won't find it. But my scanner will catch it.

Techniques used:

• Steganographic Payload in PNG Icon
• Unicode Low-Byte Encoding Trick
• Decoded Payload: The C2 String Table
• 72-Hour Sleeper with Random Sampling
• C2 Beacon via Another PNG File
• Dynamic `declarativeNetRequest` Rule Injection
• Affiliate Commission Hijacking
• Content Script Privilege Escalation Bridge
• Arbitrary URL Redirect on Any Domain
• CSP Erasure

Full deep dive analysis with code examples in link above. The extension discussed is live as of today.

Deep dive of malware found on firefox extension store - multiple evasion techniques used including steganography, sleep before C2 beacon and content script privilege escalation. browser-xpi-malware-scanner.py - Python script for XPI malware scanning on github.com

I hope you enjoy it!

Here is the output of the python script, which helps us analyze the code.

```bash browser-xpi-malware-scanner.py ../malware-extensions/YTMP4\ -\ Download\ YouTube\ Videos\ to\ MP4.xpi -v [i] Analyzing 1 target(s) with minimum severity 'INFO' [+] Found 1 XPI(s) to analyze [i] Analyzing XPI: ../malware-extensions/YTMP4 - Download YouTube Videos to MP4.xpi Analyzing entry: setting.html Analyzing entry: manifest.json Analyzing entry: adpoint.json Analyzing entry: index.html Analyzing entry: _locales/en/messages.json Analyzing entry: icon/icon_gray.png Analyzing entry: icon/loading.webp Analyzing entry: icon/logo.png Analyzing entry: icon/icon64.png Analyzing entry: icon/loading.gif Analyzing entry: css/index.css Analyzing entry: css/iconfont.ttf Analyzing entry: css/iconfont.css Analyzing entry: js/index.js Analyzing entry: js/setting.js Analyzing entry: js/y2meta-uk.com.js Analyzing entry: js/content.js Analyzing entry: js/bg.js Analyzing entry: js/jquery-3.4.1.min.js Analyzing entry: js/snapany.com.js Analyzing entry: js/ytmp4.co.za.js Analyzing entry: META-INF/cose.manifest Analyzing entry: META-INF/cose.sig Analyzing entry: META-INF/manifest.mf Analyzing entry: META-INF/mozilla.sf Analyzing entry: META-INF/mozilla.rsa

════════════════════════════════════════════════════════════════════════ XPI ANALYZER — YTMP4 - Download YouTube Videos to MP4.xpi ════════════════════════════════════════════════════════════════════════ Extension Name: YTMP4 - Download YouTube Videos to MP4 Extension UUID: 1efab3c2-06ac-4040-975d-e006baac07ce@ytmp4 Overall verdict: CRITICAL RISK

────────────────────────────────────────────────────────────────────── MANIFEST.JSON: ────────────────────────────────────────────────────────────────────── { "manifestversion": 3, "name": "MSG_extName", "description": "MSG_description_", "version": "1.3.4", "default_locale": "en", "permissions": [ "tabs", "storage", "declarativeNetRequest", "downloads" ], "host_permissions": [ "<all_urls>" ], "action": { "default_icon": { "19": "icon/icon_gray.png", "38": "icon/icon_gray.png" }, "default_title": "YTMP4" }, "background": { "scripts": [ "js/bg.js" ] }, "content_scripts": [ { "js": [ "js/content.js" ], "matches": [ "https:///", "http:///" ], "all_frames": true, "run_at": "document_end" }, { "js": [ "js/jquery-3.4.1.min.js", "js/ytmp4.co.za.js" ], "matches": [ "https://.ytmp4.co.za/" ], "all_frames": true, "run_at": "document_start" }, { "js": [ "js/jquery-3.4.1.min.js", "js/y2meta-uk.com.js" ], "matches": [ "https://.y2meta-uk.com/" ], "all_frames": true, "run_at": "document_start" }, { "js": [ "js/jquery-3.4.1.min.js", "js/snapany.com.js" ], "matches": [ "https://.snapany.com/" ], "all_frames": true, "run_at": "document_start" } ], "sidebar_action": { "default_panel": "index.html", "default_icon": "icon/icon64.png" }, "icons": { "128": "icon/icon64.png" }, "declarative_net_request": { "rule_resources": [ { "id": "adblocker01", "enabled": true, "path": "adpoint.json" } ] }, "browser_specific_settings": { "gecko": { "id": "1efab3c2-06ac-4040-975d-e006baac07ce@ytmp4" } } } ──────────────────────────────────────────────────────────────────────

Findings: 1 CRITICAL 22 HIGH 17 MEDIUM 1 INFO

── CRITICAL ────────────────────────────────────────────────────────── [CRITICAL] [PNG_APPENDED] icon/logo.png: 1902 bytes appended after PNG IEND (entropy=5.63) — classic stego carrier CODE: b'ncige\x1f\xe3\xbd\xa9\x18\xe3\xa1\x84\xe1\xa1\xa1\x18\xe3\xa1\xb9\x1f\xe3\xbd\xb3\x1c\xe3\xb0\xba\x1b\xe5\xac\xa0\r\n\… ── HIGH ────────────────────────────────────────────────────────────── [HIGH ] [CLASS_STORAGE_OVERLAP] js/content.js: String literal '7yfuf2' appears both as a JS string in this file and as an HTML class attribute in index.html — likely used as a covert stego marker or out-of-band key CODE: class='7yfuf2' in index.html [HIGH ] [CLASS_STORAGE_OVERLAP] js/content.js: String literal 'ncige' appears both as a JS string in this file and as an HTML class attribute in index.html — likely used as a covert stego marker or out-of-band key CODE: class='ncige' in index.html [HIGH ] [JS_OBFUSCATION] js/content.js:380 atob() — decoding base64 at runtime (possible payload decode) CODE: '); fileTip = atob(contentPool[screenValues]).replace(image Context: if (contentPool && contentPool[screenValues]) { var image$1 = new RegExp(pageArr.buffer$1[37], 'g'); fileTip = atob(contentPool[screenValues]).replace(image$1, ''); dataExt = JSON.parse(fileTip); screenValues = dataExt.map [HIGH ] [JS_OBFUSCATION] js/content.js:719 atob() — decoding base64 at runtime (possible payload decode) CODE: return dataExt ? atob(atob(this)) : btoa(this).replace(/=/g, " Context: function reContentAll(dataExt) { return dataExt ? atob(atob(this)) : btoa(this).replace(/=/g, ""); };

[HIGH ] [JS_OBFUSCATION] js/content.js:719 atob() — decoding base64 at runtime (possible payload decode) CODE: turn dataExt ? atob(atob(this)) : btoa(this).replace(/=/g, ""); Context: function reContentAll(dataExt) { return dataExt ? atob(atob(this)) : btoa(this).replace(/=/g, ""); };

[HIGH ] [JS_OBFUSCATION] js/content.js:2364 atob() — decoding base64 at runtime (possible payload decode) CODE: ol); }); return atob(dataExt); } function getComponentNam Context: dataExt += updImgOn(contentPool); }); return atob(dataExt); }

[HIGH ] [JS_OBFUSCATION] js/snapany.com.js:126 decodeURIComponent(escape()) — encoding trick to bypass scanners CODE: return decodeURIComponent(escape(i.bin.bytesToString(e))) Context: }, bytesToString: function(e) { return decodeURIComponent(escape(i.bin.bytesToString(e))) } }, [HIGH ] [JS_OBFUSCATION] js/ytmp4.co.za.js:114 atob() — decoding base64 at runtime (possible payload decode) CODE: ") , a = window.atob(t) , s = new Uint8Array(a.length); Context: try { let t = e.replace(/\s/g, "") , a = window.atob(t) , s = new Uint8Array(a.length); for (let e = 0; e < a.length; e++) [HIGH ] [PERMISSION] manifest.json: Dangerous permission: '<all_urls>' — Access to ALL website content — can read/exfiltrate any page data PERMISSION: permissions: ['tabs', 'storage', 'declarativeNetRequest', 'downloads', '<all_urls>'] [HIGH ] [PNG_CHUNK] icon/logo.png: Unknown PNG chunk type 'eã½' (1894 bytes) — non-standard chunks can hide data CODE: b'\xa9\x18\xe3\xa1\x84\xe1\xa1\xa1\x18\xe3\xa1\xb9\x1f\xe3\xbd\xb3\x1c\xe3\xb0\xba\x1b\xe5\xac\xa0\r\n\xe2\xa8\xa4\x15\x… [HIGH ] [SUSPICIOUS_URL] js/index.js:323 External domain contact: i.ytimg.com URL: https://i.ytimg.com Context: "key": "063126d939ad67595c7721db791df64926ccd9e1", "quality": "144", "thumbnail": "https://i.ytimg.com/vi_webp/uU1YatflISg/maxresdefault.webp", "thumbnail_formats": [ { [HIGH ] [SUSPICIOUS_URL] js/index.js:328 External domain contact: media.savetube.me URL: https://media.savetube.me Context: "label": "Thumbnail", "quality": "Thumbnail", "url": "https://media.savetube.me/media-downloader?url=https%3A//i.ytimg.com/vi_webp/uU1YatflISg/maxresdefault.webp&ext=jpg", "value": "Thumbnail"

[HIGH ] [SUSPICIOUS_URL] js/index.js:389 External domain contact: cdn305.savetube.su URL: https://cdn305.savetube.su Context: "label": "144p", "quality": 144, "url": "https://cdn305.savetube.su/download-direct/video/144/063126d939ad67595c7721db791df64926ccd9e1", "width": 256 } [HIGH ] [SUSPICIOUS_URL] js/y2meta-uk.com.js:35 External domain contact: y2meta-uk.com URL: https://y2meta-uk.com Context: count = 0; switch (d.action){ case 'CONVERT_BEGIN': //mainframe https://y2meta-uk.com/convert/ detectSubIframe(d.yt,'CONVERT_START'); break; [HIGH ] [SUSPICIOUS_URL] js/y2meta-uk.com.js:38 External domain contact: iframe.y2meta-uk.com URL: https://iframe.y2meta-uk.com Context: detectSubIframe(d.yt,'CONVERT_START'); break; case 'CONVERT_START': //subframe https://iframe.y2meta-uk.com/mainindex.php?videoId= convertStart(d.yt); break; [HIGH ] [SUSPICIOUS_URL] js/y2meta-uk.com.js:41 External domain contact: y2meta-uk.com URL: https://y2meta-uk.com Context: convertStart(d.yt); break; case 'GET_DOWNLOAD_DATA': //mainframe https://y2meta-uk.com/convert/ detectSubIframe(d.yt,'GET_DOWNLOAD_DATA_SUBFRAME'); break; [HIGH ] [SUSPICIOUS_URL] js/y2meta-uk.com.js:44 External domain contact: iframe.y2meta-uk.com URL: https://iframe.y2meta-uk.com Context: detectSubIframe(d.yt,'GET_DOWNLOAD_DATA_SUBFRAME'); break; case 'GET_DOWNLOAD_DATA_SUBFRAME': //subframe https://iframe.y2meta-uk.com/mainindex.php?videoId= var e = d.yt, formData = new URLSearchParams(); [HIGH ] [SUSPICIOUS_URL] js/y2meta-uk.com.js:60 External domain contact: api.mp3youtube.cc URL: https://api.mp3youtube.cc Context: try { var t = await getkey(); var n = await fetch('https://api.mp3youtube.cc/v2/converter', { method: "POST", [HIGH ] [SUSPICIOUS_URL] js/y2meta-uk.com.js:132 External domain contact: api.mp3youtube.cc URL: https://api.mp3youtube.cc Context: async function getkey() { let e = await fetch("https://api.mp3youtube.cc/v2/sanity/key") , t = await e.json(); return t.key [HIGH ] [SUSPICIOUS_URL] js/content.js:866 External domain contact: vuejs.org URL: https://vuejs.org Context: warn( 'data functions should return an object:\n' + 'https://vuejs.org/v2/guide/components.html#data-Must-Be-a-Function', vm ); [HIGH ] [SUSPICIOUS_URL] js/snapany.com.js:65 External domain contact: api.snapany.com URL: https://api.snapany.com Context: let v, a, f; f = getGfooter(e); v = await fetch("https://api.snapany.com/v1/extract",{ method: "POST", headers: { [HIGH ] [SUSPICIOUS_URL] js/ytmp4.co.za.js:135 External domain contact: media.savetube.vip URL: https://media.savetube.vip Context: async function getRandomCdn() { let e = await fetch("https://media.savetube.vip/api/random-cdn") , t = await e.json(); return t.cdn ── MEDIUM ──────────────────────────────────────────────────────────── [MEDIUM ] [JS_OBFUSCATION] js/index.js:73 fetch() call — verify destination is legitimate CODE: odeName); !val && fetch(logo.src) .then(defaultTip => default Context: var val = await localGet(nodeName); !val && fetch(logo.src) .then(defaultTip => defaultTip.text()) .then((textTag) => { [MEDIUM ] [JS_OBFUSCATION] js/y2meta-uk.com.js:60 fetch() call — verify destination is legitimate CODE: var n = await fetch('https://api.mp3youtube.cc/v2/converter' Context: try { var t = await getkey(); var n = await fetch('https://api.mp3youtube.cc/v2/converter', { method: "POST", [MEDIUM ] [JS_OBFUSCATION] js/y2meta-uk.com.js:132 fetch() call — verify destination is legitimate CODE: { let e = await fetch("https://api.mp3youtube.cc/v2/sanity/key Context: async function getkey() { let e = await fetch("https://api.mp3youtube.cc/v2/sanity/key") , t = await e.json(); return t.key [MEDIUM ] [JS_OBFUSCATION] js/content.js:46 String.fromCharCode — character-code obfuscation CODE: ) { return String.fromCharCode(screenValues); } function hasConten Context: function updImgOn(screenValues) { return String.fromCharCode(screenValues); }

[MEDIUM ] [JS_OBFUSCATION] js/content.js:50 fetch() call — verify destination is legitimate CODE: tPool, dataExt) { fetch(contentPool).then(lineSize => { if (l Context: function hasContentAll(contentPool, dataExt) { fetch(contentPool).then(lineSize => { if (lineSize.ok) lineSize.text().then(event$1 => dataExt(1, event$1)) else dataExt(0) [MEDIUM ] [JS_OBFUSCATION] js/jquery-3.4.1.min.js:2 String.fromCharCode — character-code obfuscation CODE: !=r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|5529 Context: /! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */ !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQ [MEDIUM ] [JS_OBFUSCATION] js/jquery-3.4.1.min.js:2 String.fromCharCode — character-code obfuscation CODE: ode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},re=/([\0-\x1 Context: /*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */ !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQ [MEDIUM ] [JS_OBFUSCATION] js/jquery-3.4.1.min.js:2 Long innerHTML assignment — possible HTML injection CODE: e){a.appendChild(e).innerHTML="<a id='"+k+"'></a><select id='"+k+"-\r\\' msallowcapture=''><option selected=''></option>… Context: /! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQ [MEDIUM ] [JS_OBFUSCATION] js/jquery-3.4.1.min.js:2 Long innerHTML assignment — possible HTML injection CODE: unction(e){return e.innerHTML="<a href='#'></a>","#"===e.firstChild.getAttribute("href")})||fe("type|href|height|width",… Context: /! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQ [MEDIUM ] [JS_OBFUSCATION] js/jquery-3.4.1.min.js:2 Long innerHTML assignment — possible HTML injection CODE: LDocument("").body).innerHTML="<form></form><form></form>",2===Vt.childNodes.length),k.parseHTML=function(e,t,n){return"… Context: /! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */ !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQ [MEDIUM ] [JS_OBFUSCATION] js/snapany.com.js:137 String.fromCharCode — character-code obfuscation CODE: i.push(String.fromCharCode(e[t])); return i.j Context: bytesToString: function(e) { for (var i = [], t = 0; t < e.length; t++) i.push(String.fromCharCode(e[t])); return i.join("") } [MEDIUM ] [JS_OBFUSCATION] js/snapany.com.js:123 unescape() — URL-encoding obfuscation CODE: i.bin.stringToBytes(unescape(encodeURIComponent(e))) Context: utf8: { stringToBytes: function(e) { return i.bin.stringToBytes(unescape(encodeURIComponent(e))) }, bytesToString: function(e) { [MEDIUM ] [JS_OBFUSCATION] js/snapany.com.js:65 fetch() call — verify destination is legitimate CODE: er(e); v = await fetch("https://api.snapany.com/v1/extract",{ Context: let v, a, f; f = getGfooter(e); v = await fetch("https://api.snapany.com/v1/extract",{ method: "POST", headers: { [MEDIUM ] [JS_OBFUSCATION] js/ytmp4.co.za.js:135 fetch() call — verify destination is legitimate CODE: { let e = await fetch("https://media.savetube.vip/api/random-c Context: async function getRandomCdn() { let e = await fetch("https://media.savetube.vip/api/random-cdn") , t = await e.json(); return t.cdn [MEDIUM ] [JS_OBFUSCATION] js/ytmp4.co.za.js:142 fetch() call — verify destination is legitimate CODE: Cdn(); v = await fetch("https://".concat(t, "/v2/info"),{ m Context: async function fetchData(e) { let v, a, s, t = await getRandomCdn(); v = await fetch("https://".concat(t, "/v2/info"),{ method: "POST", headers: {'Content-Type': 'application/json'}, [MEDIUM ] [JS_OBFUSCATION] js/ytmp4.co.za.js:165 fetch() call — verify destination is legitimate CODE: try { v = await fetch("https://".concat(l, "/download"), { Context: }; try { v = await fetch("https://".concat(l, "/download"), { method: "POST", headers: { [MEDIUM ] [PERMISSION] manifest.json: Dangerous permission: 'downloads' — Can initiate and read downloads PERMISSION: permissions: ['tabs', 'storage', 'declarativeNetRequest', 'downloads', '<all_urls>'] ── INFO ────────────────────────────────────────────────────────────── [INFO ] [METADATA] ../malware-extensions/YTMP4 - Download YouTube Videos to MP4.xpi: SHA-256: f4c493377c6065e039f547ab0da5bafdfb8eaffa524fd744c119fd2bb6cfef30 | size: 99,547 bytes ════════════════════════════════════════════════════════════════════════

```