Twitch extension with 30K installs exposes users’ OAuth tokens

There’s a strange, almost metaphysical trust we place in browser extensions. We click “Add to Chrome” with the same casual confidence we’d use to open a door in a spaceship, assuming the air on the other side is breathable. The Twitch Enhanced Viewer | JeetBot case shatters that assumption in a beautifully mundane way: not a sophisticated state actor, not a zero-day exploit, but a simple, almost lazy betrayal of trust. Your OAuth token is the key to your digital identity—a skeleton key that lets someone impersonate you without ever needing your password. And here, it was being handed over to a commercial bot service, likely to inflate viewer counts or automate chat interactions. What fascinates me is the layered weirdness of this ecosystem. We have a marketplace (the browser store) that acts like a trusted curator, but it’s really just a bazaar. We have a token system designed to make authentication seamless, but that same seamlessness becomes a vulnerability when it’s abused. And we have the users—30,000 of them—who, like most of us, never read the fine print of the permissions they grant. The extension wasn’t some shady download from a dark corner of the web; it was in the official stores, wearing the badge of legitimacy. That’s the cosmic horror of it: the familiar is not safe. This story also echoes a deeper theme in our modern mythology: the idea of the “golem” or the “automaton” that turns on its creator. We build these little digital helpers to enhance our experience—watching Twitch, managing our chats, boosting our streams—and sometimes they grow a hidden agenda. The bot service is the puppet master, pulling strings through a piece of code that was supposed to be a harmless tool. It’s a reminder that every line of code is a decision, and every decision has a consequence we might not see until it’s too late. The good news is that this particular horror story has a practical fix: revoke the extension’s access, change your tokens, and be more careful about what you install. But the philosophical takeaway lingers. We are all walking through a digital jungle, where the most beautiful-looking plants can have thorns. The only defense is a kind of informed paranoia—a willingness to question the tools we use, even when they come from the “official” store. In a universe where reality is already weirder than we imagine, it’s the unexpected twists in our own code that keep us on our toes. Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/)