{
  "schema_version": "1.6.0",
  "id": "CLR-2026-2998",
  "modified": "2026-07-08T01:00:00Z",
  "published": "2026-07-08T01:00:00Z",
  "summary": "A Steam “accelerator” extension that reads your Steam session and proxies your Steam traffic",
  "details": "The Chrome extension 88狗 is a Chinese Steam market + “accelerator” (proxy) tool. To do its job it reads the user’s Steam session (the sessionid cookie and the public 17-digit SteamID out of steamLoginSecure), sends the session id and the user’s friend data to its own backend at a raw IP (http://120.55.185.135:62), automates Steam actions on the user’s behalf, sells services via Alipay, and routes Steam traffic through the operator’s proxy. It requests very broad permissions — <all_urls>, proxy, cookies, webRequestBlocking. We classify it as abuse tooling / greyware: it is not a covert credential stealer (the raw IP is its own declared backend, and the “remote code” flag is a local packaged script — both scanner over-reads we corrected) — but, unlike scoped automation extensions, it does carry a real privacy/session risk to the installer.",
  "affected": [
    {
      "package": {
        "ecosystem": "Chrome",
        "name": "88狗"
      },
      "versions": [
        "1.0.1.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2998-88gou-steam"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2998",
    "kind": "abuse",
    "class": "Abuse tooling / greyware",
    "severity": "High",
    "status": "Confirmed abuse tooling (greyware)",
    "iocs": {
      "ips": [
        "120.55.185.135"
      ],
      "hashes": [],
      "indicators": [
        "88狗 — Chrome Web Store id cmpopiedmjniammgjfeioofnofgncnlb, v1.0.1",
        "permissions: storage, activeTab, webRequest, webRequestBlocking, , background, cookies, tabs, proxy · content scripts on steamcommunity.com / store.steampowered.com",
        "background_dog.js: chrome.cookies.getAll(domain=steamcommunity.com) → sessionid + steamLoginSecure.substring(0,17) (public SteamID); fetches friends list, POSTs {friendCode, steamId, steamName} + sessionid",
        "Own backend at raw IP http://120.55.185.135:62 — /api/user/user, /api/user/price, /api/pay/*, /api/user/order/*, /api/user/accelerate/url (Alipay payment flow)",
        "chrome.proxy.settings.set with a PAC script routes Steam traffic through the operator — on-path for the user’s full Steam session (steamLoginSecure travels in proxied requests)",
        "Corrected over-reads: raw IP = own declared backend (not C2); \"remote-code\" = chrome.runtime.getURL LOCAL bundled script; only the PUBLIC SteamID is extracted, not the secret token"
      ]
    }
  }
}