THE STEAM DOSSIERThe “non-casino” in the 2016 enforcement record now directs users into an extension with external commerce, advertising and remote Steam-account operations.
This case tests Valve’s account of control against a concrete, observable system. Follow the connection from CSGOFast’s trading interface to Steam Inventory Helper, from its visible storefront to its background commands, and from account bans to the commercial infrastructure that remains reachable. [P01] [P04] [P10]
PhishDestroy’s supplied screenshots show the extension in a logged-out Steam browser interface; no Steam account was used for this observation. The code review was static: no account was connected and no remote task was executed. Visible integration, executable client paths and observed server behavior are recorded separately.
Valve’s October 2016 response to the Washington State Gambling Commission reported notices to more than forty sites and closure of their Steam accounts. It also described identification limits and replacement bot accounts. [P01]
“we shut down the Steam accounts of these sites”
VALVE LEGAL COUNSEL / 17 OCTOBER 2016 / LETTER TO WSGC
The letter’s claim concerns accounts. Its explanation of OpenID described identification without handing Steam credentials to another site. The extension examined here reaches further: its registered code includes a token-return handler and server-directed Steam operations. That is the mechanism against which the old account of enforcement must now be tested. [P01] [SC31]
CSGOFast was named in the July 2016 notice record. A contemporary report also preserved its announcement of a shutdown and stopped bots. The present evidence establishes a later commercial integration; it does not require a claim that the business never paused. The question for Valve is the outcome over time: which operator capabilities were removed, which returned, and under whose authorization? [P03] [P04] [P10]
Valve’s July statement identified automated accounts making the same web calls as ordinary users and said gambling-business use violated its agreements. The restriction addressed the business conducted through Steam. [P02]
CSGOFast’s client checks SIH connection and permission state. SIH’s enabled client can use a logged-in Steam session to carry out a remote task. Closing an operator’s historical inventory bots does not, by itself, demonstrate control of this architecture. [P10] [SC03] [SC08]
The supplied browser captures put the commercial proposition in view: two advertising placements, an external market tab, game offers compared with Steam prices, an authenticator promotion and a subscription that removes ads. These are the displayed offers; no purchase or advertised saving was tested.
The Steam masthead remains visible. SIH adds its own tab and controls while a skin-case advertiser occupies the top and side of the interface.
The captured storefront labels its offers “Cheaper than Steam” and displays discounts, country availability and a Finland region filter. The screenshot establishes the comparison and sales interface, not a completed purchase or proof of the visitor’s physical location.
Open the original exhibit at full size ↗
The panel displays SIH.Black at $2.33 per month, bulk order relisting, additional price sources and an ad-free feature. This is a captured offer, with its billing conditions outside the screenshot. The same product supplies the promotional layer and sells a version without it.
Open the original exhibit at full size ↗
The address shown is steamcommunity.com/market/. External buy buttons and percentage comparisons occupy the item list; the right column promotes SIH’s mobile SDA. The separate supplied sign-in capture also promotes automatic confirmations and multiple-account support. Its sign-in QR is not reproduced here.
Open the original exhibit at full size ↗The commercial strategy visible across these screens is cumulative: obtain installation through useful inventory tools, occupy the Steam interface, route attention toward outside purchases, sell added automation and charge for an ad-free experience. This is PhishDestroy’s reading of the displayed product design. Its legal and technical implementation is examined below, rather than inferred from the banners alone.
For Valve, the issue is concrete. Its platform is the place where another business presents commerce and requests access. A meaningful enforcement account must explain how Steam’s rules on account use, automation and marketplace modification apply to the observed integration. [P16] [P17]
The reviewed worker registers a WebSocket provider, a heartbeat, a dispatcher and handlers for consequential Steam actions. This is a command-and-control channel in the technical sense: instructions arrive remotely, client code performs a supported operation, and results can return to the server. [SC01–08]
Assign a supported task and configure controller eligibility.
WSS → registered handlersExtension permissions, a Steam session and operating gates.
Receive the authenticated request and apply Steam’s checks.
Read · sell · remove · tradeTask results return to the controller. A separately verified path uploads observed prices to SIH’s data service.
The dispatcher includes individual and batch price reads, listings, market history and wallet currency. A price handler calls a fixed Steam market endpoint. Its batch can stop on rate limiting. The code establishes remotely assignable Steam-market work; it does not establish complete coverage of Steam or a million simultaneous workers. [SC07–11]
Named market tasks include selling items and removing listings. Separate registered handlers send, accept, decline and cancel trade offers. The send path supplies local Steam session material. A successful request still depends on session state, applicable permissions, Steam checks and any required confirmation. [SC09] [SC12–13]
The local market-controller setting defaults off. The runner checks it and Steam authorization. Server configuration supplies a controller switch and eligible SteamID suffixes; pending-order branches also affect operation. A permission request creates an unaccepted record and opens a popup. These gates matter to the actual reach of the system. [SC03–06] [SC13]
Animation illustrates the route only. It sends no request and estimates no request rate. Every code location below belongs to a pinned package.
Four consequences deserve separate attention: the operator can assign tasks; the client holds the session context; the workload runs from the client’s network exit; and Valve receives account-authenticated requests. The exit may be a home connection, institution, VPN or proxy. The architecture places commercial work and account authority on user devices. It does not make that traffic invisible to Steam. [SC14–16]
Persistent transport, a fixed task vocabulary, session-based operations, response messages and server-controlled eligibility are inspectable in the package. This is the substantive finding behind the supplied report’s “botnet” characterization.
Distributed market requests and remote account operations create leverage over connected clients. A compromised or abusive controller could misuse supported operations. The audit does not establish a remotely exposed arbitrary-target flood command, an unlimited rate or a completed DDoS attack.
The million-user Store figure measures public distribution. No server telemetry establishes how many agents were enabled, online or assigned work. Host permissions do not by themselves prove a command capable of targeting any URL. These are specific limits of the evidence, not limits on the importance of remote account control.
The enforcement target can move from a casino’s bot inventory to work performed through its customers’ accounts. Valve’s explanation must follow that change.
SIH contains a Steam authenticator subsystem, automatic-confirmation features, local account records and a cloud-backup route. The important questions are which feature is enabled, where the records go, and who can decrypt or operate them. [SC17–25]
The backup helper serializes stored maFiles and a manifest, wraps the data in Base64 and submits it to SIH’s backup service. The normal UI defaults backup off and checks encryption; ordinary sync paths require an encrypted manifest and the backup setting. A separate explicit backup-message path also exists. [SC17–23]
Base64 adds no encryption. It can, however, wrap records already encrypted before storage. Unlocking the authenticator does not itself rewrite those stored records as plaintext. The precise risk is cloud custody of sensitive records plus client-side control and key handling; server compromise alone has not been shown to unlock every account.
The publisher’s 2 August 2026 mobile announcement describes multiple accounts, account import and automatic trade/market confirmations. It says authentication keys remain encrypted on the phone and are not sent to company servers. That claim concerns the mobile product; this audit inspected the browser extension. [P13]
A November 2024 desktop update already advertised deletion of cloud data. Mobile marketing cannot establish the storage behavior of every browser-SDA path. Each product and backup mode needs its own account of custody. [P14]
Automation changes the practical role of confirmation: a security decision that a user might otherwise review individually can become an enabled workflow across accounts. The code does not establish that every trade succeeds or that every user enables automation. It establishes that the commercial product offers machinery for this purpose.
Valve’s enforcement question reaches the authentication layer. Which third-party account-control and automatic-confirmation integrations does it authorize, how are those decisions documented, and what protection remains for users when an outside controller or its software fails? A total of banned accounts does not answer those questions. [P16]
The visible side sells attention and access to offers. The background contains remote work, price uploads, account context and diagnostics. Their existence can be traced without assuming that every data stream is sold, every user is active or every backend has the same controller.
| Path | What the record shows | Consequence for the Valve inquiry |
|---|---|---|
| Remote price tasks | Individual and batch Steam-market lookups return task results. The batch handles Steam rate limiting. [SC07–11] | Commercial data collection can use an enabled customer client rather than an operator-owned bot. |
| Observed-price upload | A separate path submits price observations to SIH’s items service and processes a response-specified delay. [SC16] | The browser is also a data source. A one-to-one transfer of every remote result into a resold dataset has not been established. |
| Dynamic request rules | Cookie access and request-header rules support authenticated Steam calls. [SC14–15] | “A normal user request” can describe its credentials while omitting who assigned the operation. |
| Account diagnostics | Sentry configuration attaches Steam/SIH profile context as extras and disables automatic Breadcrumbs. Runtime payload contents were not captured. [SC26–27] | The data-handling question includes operator-side account context, not only what is painted on Steam’s pages. |
| Ad selection | General ad requests carry country and language inputs. The add-funds placement separately checks the Steam page’s Russian-language setting. [SC28–30] | There is code support for contextual variation. A language condition alone cannot establish geographic targeting or a visitor’s country. |
| HTTP ad destination | The add-funds banner points to a literal-IP HTTP link; its images are packaged assets. [SC28–29] | The initial click destination is unencrypted. This code does not show the remote IP supplying a replaceable image inside Steam. |
SIH’s privacy policy describes contextual promotions and distinguishes local processing from server collection. It says authentication secrets are not used for advertising or sent to unrelated services. That statement must be tested against the relevant path: advertising selection, remote token return and authenticator backup are different operations. A blanket label of “local processing” cannot substitute for tracing where a particular value goes. [P09] [SC31]
Google’s rules for ads alongside another website require disclosure, clear attribution, no interference and no impersonation of the host’s content. Continued Store availability is not a finding that each placement complies. Nor is Valve’s lack of a visible objection proof of authorization. The captures make the placement reviewable; the enforcement record must establish what each platform actually decided. [P18]
The original 2.11.12 report catalogues the WSS controller, ad-serving and impression reporting, item-price uploads, history/statistics, the controller ping, cloud backups, inventory proxies, game statistics and event streams. It also records referral placements. The new source check confirms selected paths above; the full original inventory remains in the supplied report. These endpoints are documented as evidence, not contacted by this page.
CSGOFast presents its activity as outside gambling. SIH’s extension terms deny gambling-related promotion and describe an advertising/information service. The screenshots, transaction record and command paths provide concrete tests of those representations. [P11] [P08]
SIH’s terms separate the extension from trading, incorporate SIH.app rules for balances and subscriptions, and reserve identity-verification powers. Its own content licence is limited to personal, noncommercial use. The product’s commercial surfaces deserve scrutiny under these distinctions. [P08]
The Chrome listing also displays a Non-trader declaration. It is a publisher declaration, not a regulator’s assessment of the business or an exemption from Steam’s rules. [P07]
The Dutch Ksa’s 2025 Gamusoft order records Steam login from a Dutch IP, a $6 bitcoin deposit credited as 9.22 F, participation in Double and a bitcoin withdrawal route. Its published record calls csgofast.com an unlawful gambling offering, says the order became final and records continuing violations and accrued penalties. [P05] [P06]
This is a named operator and a dated Dutch enforcement record. It directly tests the “non-casino” description without requiring a hypothetical account of what a user might do.
The same names and same interface do not make every contract the same. RedBoon Limited is named for the extension; the product blog identifies RedBoon FZE LLC; Ksa’s order names Gamusoft LP; a current CSGOFast footer names Lumigrid OÜ and Payplaysoft Limited. The corporate map needs documents for each relationship. Product integration is already evidenced independently of that ownership map. [P08] [P13] [P24]
For Valve, accepting an operator’s chosen label would leave the central question untouched: what commercial activity is being performed through Steam accounts and how is the prohibition enforced? [P17]
The first-party announcements put the CSGOFast relationship in 2015. A 2016 notice records an ownership change. A purchase in 2023 or 2024 has not been established; using that guess as the starting point would lose the older record.
The original developer first disclosed a sponsorship proposal, then confirmed sponsorship and an extension trade-offer banner. SIH 1.8.3 also added CSGOFast price data. The advertising and market-data relationship was already public. [P20–21]
The original announcement says an individual bought the extension. A contemporary reproduction attributes the announcement to a CSGOFast-branded Steam alias. This supports the historical connection; it is not a current beneficial-ownership register. [P22–23]
SIH’s update describes a cloud-data deletion control and expanded marketplace integrations. This is evidence of product development, not an acquisition date. [P14]
Ksa orders Gamusoft LP to stop the Dutch offering through csgofast.com. The public record later reports continued violations. [P05–06]
CSGOFast’s published frontend links SIH and checks its connection and permission state. The signed 2.12.1 client contains remote task and account-operation paths. The browser captures show what the user-facing commercial layer looks like. [P10] [PACKAGE RECORD]
The relevant rules address commercial use, account access, automation and interference with Steam’s interface or marketplace processes. Their practical meaning depends on how Valve applies them to the particular business and mechanism. [P16–17]
Valve’s current subscriber agreement restricts account sharing and unauthorized commercial use, addresses modification of Steam or its marketplace, and prohibits automation. Steam’s conduct rules identify advertising and gambling as prohibited commercial activity. An extension’s ability to run in a browser does not establish a contractual exception. The missing record is Valve’s application of these rules to the documented integration. [P16–17]
There is also a concrete legal lead on selective access. NYAG’s 2026 complaint, paragraphs 90–99, alleges distinctions between gambling sites and cash marketplaces and describes account-access decisions involving OPSkins, CSGOSell, CSFloat and Skinport. The complaint alleges that more than 2,500 Skinport accounts were unlocked in March 2024. These are filed allegations, not adjudicated findings; the restoration described is account access, not the return of stolen skins. [P15]
That record sharpens the demand: identify the decision-makers, criteria, authorizations and restrictions. A platform can count blocked accounts while withholding the decisions that determine which commercial businesses retain access. The CSGOFast/SIH case is a way to examine that gap through an actual integration.
A closed account is an enforcement event.
The survival of commercial control is an enforcement outcome.
These lines are retained explicitly so that the next evidence can extend this case without replacing its established findings.
PhishDestroy’s further review/comment audit is pending. The current Store snapshot supplies a rating count; it does not establish paid or incentivized reviews. Google prohibits manipulation through incentivized reviews and ratings. The next evidence record should retain the reward offer, required action, dated review and account linkage, rather than treating every positive review as purchased. [P07] [P19]
The supplied lead concerns a CSGOFast owner, an intermediary, a Valve decision-maker and restoration of stolen skins to another commercial business in the same region. It remains part of the investigation. Establishing it requires verified roles, dated relationship records and the original restoration decision. Public social links or a shared region do not establish that chain; account unlocking must not be substituted for stolen-item restoration.
The 2016 representations, the historical sponsor connection, the later regulator record, CSGOFast’s SIH integration, the supplied browser captures and the pinned client code stand independently. Additional personal-relationship or review evidence can strengthen the explanation of how this system persists; it is not needed to make the present system examinable.
The supplied 2.11.12 report is retained below. The follow-up independently obtained 2.12.1 from Google’s update service, verified three CRX3 signatures and matched the extension ID. Signature validity establishes archive integrity and identity correspondence; it is not a security endorsement.
Extension: Steam Inventory Helper · cmeakgjggjdlcpncigglobpjbkabhmjl
New specimen: 2.12.1 · acquired 11 October 2026, 03:32:42 UTC · 72,297,305 bytes.
CRX SHA-256: 950791bc18cfbc71e883e365078cd6e6094468c2d15aafcd1fd12413f2d289ea
Earlier specimen: official ZIP 2.11.12 · SHA-256 63755fe96c0a55826d45661f8aec56a0b173a833ddf0e64074fd5a798425bd6a. The earlier code record remains on the extension-audit page. The provided report’s transformed line numbers are not used as offsets in the new build.
Seven original files covering the 33 new locations were preserved with their hashes, alongside acquisition and signature records. All five supplied screenshot originals and the unmodified report were retained. Four screenshots are displayed here; the fifth’s sign-in QR is excluded from the web exhibits. The extension was never run during this code review. No task, Steam-account, backup or advertising endpoint was contacted.
Official acquisition source [P12] · Earlier independent audit ↗ · Machine-readable verification record ↗
The registered service worker loads the inspected background bundles; these are part of the extension’s executable background path.
FILE: service-worker.js
SHA-256: 03bc8f4d0ab34af3d93c0245ebb58a680b06443348473ea36d87cb975a48b64c
Original line 11 · zero-based anchor byte 393 · retained excerpt bytes 393–532 (end exclusive).
The client registers the WebSocket transport and a setting governing market-controller behavior.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,213,154 · retained excerpt bytes 1,213,004–1,213,472 (end exclusive).
Connection heartbeat and runner are client capabilities, not observed live traffic.
The runner checks both the local controller setting and Steam authorization before taking the reviewed path.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 513,761 · retained excerpt bytes 513,451–513,783 (end exclusive).
The default configuration disables the local market-controller switch. Enabled clients, rather than every installation, define the relevant population.
FILE: bundle/js/common.js
SHA-256: c7f12e778d48dffc105ab3a784b35b4d49967c38d4f1646e405d04126781a976
Original line 1 · zero-based anchor byte 213,540 · retained excerpt bytes 213,540–213,564 (end exclusive).
The server response can supply the controller switch, account-suffix cohort and request cadence.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 465,316 · retained excerpt bytes 465,136–465,768 (end exclusive).
Eligibility combines server-selected account suffixes with order-related branches. The operator’s configuration shapes the participating client population.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,224,975 · retained excerpt bytes 1,224,975–1,225,810 (end exclusive).
Last-digit membership is not measured fleet size. Pending-order branches can also enable the controller.
The market controller declares nine named task types covering the reviewed market operations.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 531,463 · retained excerpt bytes 531,463–532,086 (end exclusive).
The dispatcher maps a received task type to a fixed handler in the shipped bundle.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,131,800 · retained excerpt bytes 1,131,800–1,132,774 (end exclusive).
This reviewed dispatcher is not an arbitrary-URL or arbitrary-code execution command.
A handler can remove a market listing through an authenticated Steam request and return the result.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 878,381 · retained excerpt bytes 878,381–878,803 (end exclusive).
The price handler builds a request to a fixed Steam market endpoint.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,045,007 · retained excerpt bytes 1,045,007–1,045,190 (end exclusive).
Batch price handling detects a rate-limit response and stops that batch. The requests remain subject to Steam’s controls.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,061,142 · retained excerpt bytes 1,061,142–1,061,462 (end exclusive).
The trade-send path uses session-associated request credentials for the Steam trade endpoint.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,200,176 · retained excerpt bytes 1,200,176–1,200,676 (end exclusive).
A permission-request record begins with acceptance set to false, and the client opens the permission interface.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 938,100 · retained excerpt bytes 938,100–938,991 (end exclusive).
This branch stores pending permission and opens the popup. This does not establish server enforcement of permissions for every command.
The extension constructs dynamic request-header rules supporting its authenticated requests.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 563,455 · retained excerpt bytes 563,455–563,638 (end exclusive).
Dynamic rule code is in the downloadable package and is inspectable; empty rules.json does not make these paths invisible to review.
The client reads the trade cookie and maintains a local request counter.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 566,554 · retained excerpt bytes 566,554–567,191 (end exclusive).
A separate price-observation upload path processes a response-specified delay.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,965,617 · retained excerpt bytes 1,965,617–1,966,087 (end exclusive).
Price collection and WSS task results are separate verified paths. A direct merge of every task result into this database was not established.
The backup function serializes stored account records and a manifest before transmitting a Base64-wrapped payload.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,474,594 · retained excerpt bytes 1,474,594–1,475,734 (end exclusive).
getAllWithKeys returns stored values. Base64 is not encryption; it can wrap already-encrypted values.
The backup helper has a server-side destination configured in the bundle.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,476,301 · retained excerpt bytes 1,476,301–1,476,351 (end exclusive).
The IndexedDB helper returns stored values together with their keys, establishing what the backup routine reads.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,331,750 · retained excerpt bytes 1,331,750–1,332,249 (end exclusive).
When a passkey is supplied, the storage path writes the encryption result. Otherwise, the path can write the object.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,524,154 · retained excerpt bytes 1,524,154–1,525,108 (end exclusive).
Passkey supplied => encryptData result stored; no passkey => object stored. Unlocking does not itself rewrite stored ciphertext as plaintext.
The normal cloud-backup UI starts disabled and checks whether encryption is enabled.
FILE: dist/assets/popup.159a19fc.js
SHA-256: 8eda3d15633c24f1b13de2c185bab91b29242cbc12485dae7378020e006da7fa
Original line 231 · zero-based anchor byte 1,002,487 · retained excerpt bytes 1,002,487–1,003,140 (end exclusive).
Ordinary import and synchronization paths check the encrypted manifest and backup preference.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,507,557 · retained excerpt bytes 1,507,557–1,507,780 (end exclusive).
A distinct explicit backup message invokes the backup helper; its conditions must be assessed as a separate path.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,822,287 · retained excerpt bytes 1,822,287–1,822,582 (end exclusive).
The backup helper itself lacks an encryption assertion. Do not call the entire system proven end-to-end encrypted solely from guarded UI paths.
The authenticator includes a concrete cipher and key-derivation implementation, making its key-handling design inspectable.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,463,199 · retained excerpt bytes 1,463,199–1,463,452 (end exclusive).
Authenticator configuration includes automatic-confirmation settings and their defaults.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 17 · zero-based anchor byte 1,465,101 · retained excerpt bytes 1,465,101–1,465,671 (end exclusive).
Diagnostics configuration attaches Steam and SIH account context as Sentry extras.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 437,403 · retained excerpt bytes 437,403–437,464 (end exclusive).
The Sentry setup disables automatic Breadcrumbs, narrowing the activity history collected by that integration.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 437,765 · retained excerpt bytes 437,765–438,069 (end exclusive).
The add-funds placement checks Russian page language and links to a literal-IP HTTP destination.
FILE: js/siteExt/addfunds.bundle.js
SHA-256: c274980235bfa14acefe1efb546eed6a3b32258ce2cdf5e48acd5cb476d3b863
Original line 1 · zero-based anchor byte 749 · retained excerpt bytes 749–1,359 (end exclusive).
This is a language test, not proof of IP geolocation. The HTTP literal is the link destination, not an image-fetch URL.
The advertisement image paths point into packaged assets.
FILE: js/siteExt/addfunds.css
SHA-256: 661ddafed2d7dbbdd2b129352d79c021cfccedbe21a44d00d3c80913e593c8c4
Original line 1 · zero-based anchor byte 285 · retained excerpt bytes 285–481 (end exclusive).
A general ad-serving request supplies country and language inputs for selection.
FILE: bundle/js/common.js
SHA-256: c7f12e778d48dffc105ab3a784b35b4d49967c38d4f1646e405d04126781a976
Original line 1 · zero-based anchor byte 97,063 · retained excerpt bytes 97,063–97,140 (end exclusive).
Shows targeting inputs; does not prove a specific geography-to-creative outcome.
An opaque event name maps to a handler that returns a token through the provider’s response path.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 723,953 · retained excerpt bytes 723,953–724,367 (end exclusive).
Five opaque event names map to inspectable implementation handlers in this version.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,211,303 · retained excerpt bytes 1,211,303–1,211,463 (end exclusive).
The provider maintains a heartbeat for its connection.
FILE: bundle/js/background.js
SHA-256: 14bcb727743bd44557466b86eff645074203486f3922223e780bf6d957e741ac
Original line 1 · zero-based anchor byte 1,212,997 · retained excerpt bytes 1,212,997–1,213,052 (end exclusive).
The remote command architecture, market operations, cloud-backup route, account context and integrated advertising remain central findings. The new build supplies specific boundaries that make each claim testable:
| Original claim | Checked interpretation | Evidence |
|---|---|---|
| Residential and invisible requests | Requests use the client’s network exit; rate-limit handling is explicitly present. | SC11, SC15 |
| Any target at any rate | The reviewed task dispatcher selects fixed handlers. Arbitrary-target flooding was not demonstrated. | SC07–11 |
| Unlocked SDA uploads plaintext | Backup serializes stored records, which may already be encrypted. Normal UI and sync paths add gates; a separate backup-message path needs its own review. | SC17–25 |
| HTTP banner-image substitution | The literal HTTP IP is a click destination. The displayed banner images are packaged assets. | SC28–29 |
| Opaque commands cannot be reviewed | Five opaque event names in the new build map to inspectable handlers; naming alone does not prove intent to evade review. | SC31–32 |
| Policy violations already established | Compare actual behavior, disclosures and policy requirements. Neither a publisher declaration nor this audit is a platform adjudication. | P08–09, P18–19 |
The original report is preserved as a supplied analysis. Its categorical verdicts are not silently substituted for the checked findings in the article.
Original supplied text, unchanged. Read alongside the revision record above and the separately pinned 2.12.1 evidence. Its line references refer to the author’s webcrack output.
# C2 / Distributed Task Grid — Evidence Report
## Steam Inventory Helper (SIH) v2.11.12 (`cmeakgjggjdlcpncigglobpjbkabhmjl`)
**Method.** Static analysis of the unpacked MV3 build. The webpack bundles were unpacked module-by-module with **webcrack** (`bundle/js/background.js` → 120 modules; `bundleAngular/backgroundAngular.js`; `js/siteExt/global.bundle.js` → 8 modules). Line references below point to the webcrack output (`922.js` = the main 4.1 MB module). No dynamic execution was performed; every claim is backed by decompiled code.
---
# 1. VERDICT
| Claim | Status | Basis |
|---|---|---|
| The extension operates a persistent **command-and-control (C2) channel** to developer servers | **PROVEN** | §3: WSS agent, task protocol, restart/ping logic |
| The server can **push tasks to clients** that execute **Steam market scraping** through the user's authenticated session | **PROVEN** | §4: `task.new` → `trader_tool.steam.get_price_overview(s)` etc. |
| The server can **remotely operate the user's account**: send / accept / decline / cancel trades, sell items, remove listings | **PROVEN** | §4: `tradesend`, `tradeaccept`, `tradedecline`, `tradecancel`, `sell_item(s)` |
| The server can **enable/disable and restart the agent fleet per user-bucket** (canary rollout by steamId digit) | **PROVEN** | §5: `/sih/ping` → `controllerIds`, `controller`, `timer` |
| Requests run from **residential IPs with the user's cookies** (invisible to rate-limit / anti-bot systems) | **PROVEN** | §6: cookie assembly + DNR header injection |
| The install base functions as a **distributed scraping grid** for the developer's commercial price database | **PROVEN by architecture** | §4 + §7: results uploaded to `items.steaminventoryhelper.com` and resold as "SIH Steam Median" |
| The fleet could be repurposed as a **Layer-7 DDoS instrument** | **CAPABILITY PRESENT, ABUSE NOT EVIDENCED** | §8: nothing in code commands abusive mass requests today; the transport, auth and dispatch layer to do so fully exists |
**Bottom line:** this is not a classical malware botnet (no keylogging, no arbitrary code execution from C2), but it **is a remotely-tasked execution grid over users' authenticated Steam sessions**, and its scraping tasks are distributed across residential IPs by design. Users' network reputation and session credentials power a commercial data-aggregation service.
---
# 2. FULL ENDPOINT INVENTORY (IPs / banners / logs / C2)
## 2.1 Hardcoded IP addresses
Scanned every `.js`, `.json`, `.html` in the package. **One real IP literal exists** (all other numeric patterns are library version strings):
| IP | Where | Purpose |
|---|---|---|
| `23.105.226.164` | `js/siteExt/addfunds.bundle.js` | Paid banner injected into Steam's "add funds" page: `http://23.105.226.164/Phx3RR?placement=refillpage` |
Facts that make this endpoint a finding on its own:
- **Plain HTTP** (no TLS) → any on-path attacker can substitute the image and the `target="_blank"` link target (malware interstitials, phishing).
- **Hardcoded IP, no domain** → no certificate, no revocation path, no owner accountability; typical of gray-market ad placements.
- **Locale targeting**: the banner renders only when Steam language is `ru` (`"ru"!==r` guard) and has a local "close" persistence flag — regionally-targeted undisclosed advertising inside Steam UI.
## 2.2 Banner / ad-serving endpoints
| Endpoint | Evidence |
|---|---|
| `ads.steaminventoryhelper.com/api/v1/adapi/<token>/find-all` | POST; body = targeting object `{f: {...}}` (server-side per-user ad selection); adSpaceTokens: `marketSponsor` (`mllkor7du1wiepgo`), `tradeoffer` (`2d243388513b44459fdcf78f270362c4`), `marketLeftSideBanner` (`rk1lknvys9fjx357`), `externalIntegrationBanner` (`qizy368ile7ewbuv`), `marketSponsorBanner` (`ujj9var1a8ow50lx`) |
| `download.steaminventoryhelper.com/banners` | banner + ad-token download |
| `gainskins.steaminventoryhelper.com/api/v2/sih/steam/banner(-list)` | gambling-sector banners |
| `t.sih-db.com/promo?subid1=trade_window&subid2=csgofast` | CSGOFAST referral injected in the trade window |
| `http://23.105.226.164/Phx3RR?placement=refillpage` | hardcoded-IP banner (see 2.1) |
Ad telemetry: `AD_HIT_SEND` alarm reports impressions/clicks back to the ad API.
## 2.3 Logging / telemetry endpoints
| Endpoint / channel | Payload |
|---|---|
| `wss://wss-new.steaminventoryhelper.com` (C2) | handshake: `{client:"sih-extension", clientVersion, capabilities}`; heartbeat 25 s; reconnect backoff `[10s, 10s, 20s, 30s, 50s, 80s, 130s]` |
| `sentry.steaminventoryhelper.com` DSN `3f2c5883e4126dccaf4c6e9645bf4230@.../12` | exceptions + **`userInfo` (full Steam profile) and `sihAppUserProfile` attached as event extras** (`setExtraSihUser`, 922.js:24063–24079). **Correction of earlier notes:** the `Breadcrumbs` integration is explicitly filtered out (922.js:24098–24105) — DOM/XHR breadcrumbs are NOT sent. The user-data-in-extras finding stands. |
| `items.steaminventoryhelper.com/prices/v2/update` | POST: user's observed prices `{steamid, hash_name, app_id, prices, buy_price, sold, orders, updatedAt}` (batch ≤ 1000 items) (922.js:135699–135703) |
| `core.steaminventoryhelper.com/historystatsoverprices` | POST: purchase/market history, base64, `x-sih-token`, `withCredentials` |
| `core.steaminventoryhelper.com/sih/ping` | GET with `x-sih-token`: **server→client control response** (§5) |
| `core.sih.app/sih/backups/sync` | POST: **base64 maFiles + manifest** (Steam Guard `shared_secret`/`identity_secret`), header `X-Sih-Token` (922.js:99652–99664) |
| `core.steaminventoryhelper.com/steam/check` | POST `steamUsername` |
| `skinpay.sih.app/steam-inventory/<steamId>/<appId>` | third-party inventory fetch by steamId (server-side proxy) |
| `gamestats.steaminventoryhelper.com/api/v1|v2` | key-orders, tournaments, online stats |
| Event streams | `sendEventData`, `sihEventReg`, `SEND_EVENT_REGISTRATION_V2`, `sendMircoStats`, `sendUserHistoryInfo` (background alarms) |
## 2.4 C2 event names (complete list)
Declared at 922.js:30887–30902 — this is the server→client command vocabulary:
```
connect handshake (client id, version, capabilities)
jsonsend generic command packages: refreshTradeList, balanceUpdated,
wishList, followgame, refreshWithdrawOrder, steamRefill,
updateUser, sihrep, trader_tool.steam.{get_my_listings,
sell_item, remove_listing} (922.js:58006)
tradesend server orders the client to SEND a trade offer (922.js:80728–80778 "Trade send: called")
tradeaccept server orders the client to ACCEPT a trade offer
tradedecline server orders the client to DECLINE a trade offer
tradecancel server orders the client to CANCEL a trade offer
task.new server assigns a task to the client (922.js:74793–74803)
task.result client reports the task outcome back
syncuserinfo server orders an on-demand user-data upload
permissionsget / permissionsrequest / permissionsedit
vYPRqkhY88H9iuTxrcm / vYPRgkhY88H91uTxrcm / vYPRqkhY88H91uTxrcm / vYPRqjhY88H91uTxrcm
← 4 deliberately OBFUSCATED event names (unnamed handlers)
```
`task.new` actions (922.js:30871–30879, dispatcher 74793–74803):
```
trader_tool.steam.get_my_listings
trader_tool.steam.get_market_history
trader_tool.steam.get_price_overview ← distributed price scraping
trader_tool.steam.get_price_overviews ← batch price scraping
trader_tool.steam.sell_item ← sell on the user's account
trader_tool.steam.sell_items ← mass sell
trader_tool.steam.remove_listing ← 922.js:71398–71425
trader_tool.steam.remove_listings
trader_tool.steam.get_wallet_currency
```
---
# 3. THE C2 CHANNEL (PROOF)
`service-worker.js` → `bundle/js/background.js` → agent bootstrap (922.js:80905–80951):
```js
var i = new zy.WSProvider("wss://wss-new.steaminventoryhelper.com", o, e);
n.wrap(i); // retry wrapper, delays [10s,10s,20s,30s,50s,80s,130s]
var s = new Vy(XA, i, r, a); // Vy = agent; XA = event->handler map
var c = new Yy(s, "sih_app_market_toggle", ...); // runner, 2 s poll
```
- The agent (`Vy`, 922.js:30219–30260) subscribes every handler to `provider.onmessage(type, handler)` and maintains a persistent socket with a 25-second ping and exponential reconnect backoff — standard resilient C2 transport.
- The handshake advertises `{client: "sih-extension", clientVersion, capabilities}` (922.js:30880–30886) — the server knows each node's version and feature set.
- The agent can be **stopped / restarted / re-enabled remotely** (`restartAgent`, `updateState`, `ok.run(true)` / `ok.stop(true)`, 922.js:81646–81759).
- Four event names are obfuscated (`vYPR...`), i.e. the developers deliberately hid part of the command vocabulary from casual review.
# 4. TASK EXECUTION THROUGH THE USER'S SESSION (PROOF)
Handler `task.new` → action dispatch → concrete example, remove-listing task (922.js:71398–71425):
```js
n = e.data.listingId; // task payload from the server
o = e.taskId;
zS(n, r.storage.get("steamId"), r.storage.get("sessionId")); // executed AS THE USER
r.provider.send({ event: "task.result", payload: { taskId: o, data: { ok: true, listingId: n } } });
```
The agent's storage holds **`steamId` and `sessionId` of the logged-in user**; every task executes Steam calls with those credentials, and the outcome is reported back over the C2 socket. The identical pattern applies to price-scraping tasks (`get_price_overview(s)`), which feed the commercial price database at `items.steaminventoryhelper.com` (crowd-sourced via `prices/v2/update`, resold as "SIH Steam Median" and as a paid price provider).
Additionally, the `sih_app_market_toggle` agent runs an **autonomous buy loop** (922.js:127030–127218): it takes the top item from a local buy-stack (`sihAppBuyStack`), checks `user.balance / 1000 >= price`, calls `POST /sih/buy` (with `steam_id`, `custom_trade_link`, 922.js:27465–27517), retries up to 10 iterations per item with a 10-minute deadline (`finishOrderAt = Date.now() + 600000`), and logs outcomes to the developer's storage log.
# 5. FLEET GATING — SERVER-SIDE ROLLOUT CONTROL (PROOF)
`pingUser` → `GET core.steaminventoryhelper.com/sih/ping` (922.js:25960–26029) returns:
| Server field | Client effect |
|---|---|
| `controllerIds` | stored to `AVAILABLE_CONTROLLER_LAST_NUMBER_IDS`; agent enabled only if **the last digit of the user's steamId is in the list** — 10% bucket canary control of the fleet (922.js:161250–161264) |
| `controller` | stored to `server_switch_controller` — global kill/enable switch |
| `timer` | stored to `INVENTORY_PARSING_INFO.timer` — remote tuning of inventory parsing cadence |
| `itemPayIds` | stored to `AVAILABLE_ITEM_PAY_IDS` — server-chosen item sets |
The same `/sih/ping` request uploads the user's state (`disabled` reasons, `userGemsCount`).
# 6. WHY THE TRAFFIC LOOKS LEGITIMATE (RESIDENTIAL-IP SCRAPING)
- All Steam requests originate in the **user's browser** — real residential IP, real browser TLS fingerprint, real `sessionid`/`steamLoginSecure` cookies.
- Cookies are read via `chrome.cookies` (e.g. 922.js:33450) and, where the fetch layer needs them, the extension **creates dynamic `declarativeNetRequest` rules that set the `Cookie` header** on its own requests (rule builder 922.js:124863–124912; `setRule`/`removeRule` wrapper 922.js:13161–13324). The `rules.json` shipped in the package is `[]` — all header-manipulation rules are created **dynamically at runtime**, invisible to store review.
- The code self-throttles to stay below Steam's abuse radar: `TRADE_REQUEST_LIMIT_COUNT` (> 20 → pause), `CLEAR_TRADEOFFER_REQUEST_LIMIT` alarm, `STEAM_RATE_LIMITED` handling, and a **server-controlled delay** for price uploads (`a.data.delay` from the `prices/v2/update` response, 922.js:135711–135719).
Net effect: scraping that would be blocked from datacenter IPs is laundered through hundreds of thousands of residential users — each individual client stays under the limit, while the aggregate fleet harvests continuously.
# 7. DATA LOOP (WHAT THE GRID PRODUCES)
```
fleet users ──(task.new: get_price_overview / own browsing)──► Steam endpoints
│ │
│ (residential IP + user session) ▼
│ items.steaminventoryhelper.com
│ prices/v2/update (per-user batches)
▼ ▼
C2: task.result / historystatsoverprices / Sentry userInfo aggregated price DB
│ ("SIH Steam Median",
▼ premium subscriptions)
developer-controlled commercial dataset
```
# 8. RISK ASSESSMENT
## 8.1 Proven risks
| # | Risk | Severity | Evidence |
|---|---|---|---|
| R1 | **C2 over user accounts** — the server can send/accept/decline/cancel trades and sell/remove items on every connected client | CRITICAL | §2.4, §4 |
| R2 | **Distributed scraping grid** — price-history harvesting at scale through residential IPs | CRITICAL | §4, §6 |
| R3 | **Steam Guard secrets uploaded to developer cloud** (`backups/sync`, plaintext when SDA unlocked) — server compromise = mass account takeover with 2FA bypass | CRITICAL | §2.3 |
| R4 | **Obfuscated command vocabulary** (4 unnamed `vYPR*` events) — part of the remote command surface is deliberately hidden from review | HIGH | §2.4 |
| R5 | **Fleet canary gating by steamId digit** — silent enable/disable of node capabilities per bucket | HIGH | §5 |
| R6 | **HTTP banner on hardcoded IP** (MITM content injection into Steam pages, RU-locale targeting) | HIGH | §2.1 |
| R7 | **Full economic profile exfiltration** (prices, orders, history, balances) + `userInfo` into Sentry | HIGH | §2.3 |
| R8 | Auto-confirm + auto-buy loops can move items/money with a single server-side or logic error | HIGH | §4 |
## 8.2 Capability present, abuse not evidenced (must be stated honestly)
- **Layer-7 DDoS / mass-targeting**: the transport (persistent WSS + 25 s heartbeat), the dispatch layer (`task.new`, `jsonsend`) and the authenticated request machinery exist, so the fleet **could** be pointed at any Steam or third-party endpoint at any rate the server chooses. In the audited version, task types are limited to Steam market endpoints and no command floods targets. Verdict: **capability present; no evidence of current abuse in code.**
- **Arbitrary URL fetching**: the universal HTTP client (`Gs.Ay.apiRequest`) + `<all_urls>` + dynamic DNR rules could technically fetch arbitrary hosts with arbitrary headers. The observed call graph targets Steam, SIH's own domains and 5 partner-market APIs. Verdict: same — **capability present, not exercised.**
## 8.3 Vulnerabilities (concrete, demonstrable)
1. **MITM on the ad chain**: `http://23.105.226.164/...` banner (no TLS) inside authenticated Steam pages → on-path attacker controls link/image content.
2. **Secret upload channel**: `backups/sync` base64-encodes maFiles; base64 is encoding, not encryption — server-side storage security is unknown and unauditable; combined with auto-confirm this is a full account-takeover path.
3. **Cookie-header injection machinery**: dynamic DNR `modifyHeaders` rules (runtime-created, `rules.json` empty at review time) can set any cookie value on any request the worker makes — a general-purpose session-impersonation primitive.
4. **Un-auditable remote behavior**: 4 obfuscated event names + server-pushed toggles mean the reviewed code does not equal the deployed behavior; Google's review cannot statically enumerate the command surface.
---
# 9. GOOGLE POLICY MAPPING (Chrome Web Store)
| Policy | Violated? | Mapping |
|---|---|---|
| **User Data Privacy** — limited use, disclosure, secure handling | **YES** | R3, R7: authentication secrets and full economic profiles leave the browser without prominent disclosure; "description" claims only "prices, item details, trade status" |
| **Permissions — minimum scope** | **YES** | `<all_urls>` + `cookies` + `webRequest` + `declarativeNetRequestFeedback` + `management` for a "price helper"; DNR header-injection machinery at runtime |
| **Single Purpose** | **YES** | price helper + authenticator + trade bot + C2 agent + gambling + ads in one package |
| **Deceptive / Misleading functionality** | **YES** | hidden C2 agent with obfuscated commands; undisclosed remote task execution on the user's account |
| **Ads policy** (clear labeling) | **YES** | injected sponsored banners/links in Steam UI incl. an HTTP hardcoded-IP banner targeted at RU users |
| **Malware-like behavior / remote code control** | **RISK — strongest case** | an always-on C2 socket that can operate the user's account and whose command vocabulary is partially obfuscated is, functionally, a remotely-controlled execution agent on every client |
---
# 10. APPENDIX — REPRODUCIBILITY
```bash
npx webcrack bundle/js/background.js -o bg # 120 webpack modules
npx webcrack bundleAngular/backgroundAngular.js -o ang
npx webcrack js/siteExt/global.bundle.js -o global
```
Key line references (webcrack output, main module `922.js`):
- C2 bootstrap 80905–80951; agent class 30219–30260; event names 30871–30902
- task dispatcher 74793–74803; remove-listing task 71398–71425; jsonsend 57996–58085
- tradesend handler 80728–80778; ping/control 25960–26029; steamId-bucket gate 161250–161264
- buy loop 127030–127218; /sih/buy 27465–27517; maFiles sync 99620–99679
- DNR rule engine 13161–13324; cookie-header injection 124863–124912
- Sentry extras 24063–24108; price upload 135670–135719
*All findings are static-analysis facts of the audited build; the "abuse not evidenced" qualifiers are kept deliberately to keep the report defensible.*
First-party statements, regulator and court documents, public distribution packages, and specifically identified historical reproductions. Policy pages and store listings are dated snapshots.
Letter dated 17 October 2016; publicly reproduced primary document. Account closures, notices and the OpenID explanation.
13 July 2016. Valve’s own account of automated commercial use and its agreements.
20 July 2016. Contemporary reporting reproducing the notice; historical secondary source.
27 July 2016 report of a planned 29 July closure and stopped bots; contemporary reproduction of the operator’s statement.
Dutch regulator; published 17 April 2025. Final order, continued violations and accrued penalties.
2 April 2025. Steam login, Dutch test access, bitcoin funding, F balance, Double and withdrawal route.
Snapshot 11 October 2026 UTC: 1,000,000 users; 17.9K ratings; version 2.12.1; RedBoon Limited; Non-trader declaration.
Reviewed 11 October 2026 UTC. Extension scope, gambling-related wording, advertising, incorporated product terms and identity verification.
Page updated 28 August 2026; reviewed 11 October. RedBoon Limited, data handling and contextual promotions.
Existing pinned code record CF01–CF03: extension installation, connection state, permission requests and server-side status checks.
Policy §8.1 and related claims. The dated policy snapshot is retained with the earlier AML investigation.
2.12.1 acquired 11 October 2026, 03:32:42 UTC. Full CRX hash and signatures are recorded below; a later request may return another version.
2 August 2026. Multiple accounts, import, automatic confirmations and the mobile product’s local-key claim.
22 November 2024. Cloud-data deletion and marketplace integrations; a product update, not an acquisition record.
Filed allegations, paragraphs 90–99: OPSkins, CSGOSell, CSFloat and Skinport access decisions. Account unlocking and item restoration are distinct.
Reviewed 11 October 2026. Account access, commercial use, modification and automation terms.
Reviewed 11 October 2026. Advertising, gambling and prohibited commercial activity.
Official Google requirements for advertising disclosure, attribution, interference and host-content impersonation.
Official Google policy on incentivized ratings, reviews and installation manipulation.
23 December 2015. First-party announcement identifying the CSGOFast sponsorship proposal.
31 December 2015. Sponsorship, a banner in trade offers and CSGOFast price data.
16 May 2016. First-party notice that an individual bought the extension.
Historical discussion preserves a CSGOFast-branded Steam alias. It does not identify the current legal beneficial owner.
Current footer snapshot names Lumigrid OÜ and Payplaysoft Limited. Compare dated contracts before mapping these to Gamusoft or RedBoon.