{
  "schema": "phishdestroy.reading-edition.v2",
  "schema_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/article.schema.json",
  "object_type": "Dated article reading edition with PDF digest",
  "id": "extension-audit",
  "language": "en",
  "title": "Steam sessions. Platform access. — PhishDestroy",
  "author": "Agent Cora",
  "source_url": "https://phishdestroy.io/steam_dossier/extension-audit",
  "source_file": "steam_dossier/extension-audit.html",
  "source_html_sha256": "09c3defc70c0621c4aaf7bdc8c4bc15e41aa062f19a5ae3a6fdd2b0eec880a4b",
  "exported_at": "2026-10-18T11:58:30.589Z",
  "edition_date": "2026-10-18",
  "scope": {
    "text": "Authored discussion and analytical tables from the current source HTML. Interactive controls and navigation are omitted; interactive datasets remain linked.",
    "omissions": [],
    "evidence_status": "The signature authenticates this publication, not the truth or authenticity of third-party evidence."
  },
  "pdf": {
    "filename": "extension-audit.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/extension-audit.pdf",
    "sha256": "95c96645ed58790e80c9ca548c5c5c06e2925898037d80848adb9d20c2ccc1a4",
    "bytes": 355705,
    "pages": 17
  },
  "integrity": {
    "signed_object": "extension-audit.content.json",
    "signature_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/extension-audit.content.json.asc",
    "checksum_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/extension-audit.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "scope": "Exact UTF-8 JSON bytes, including content and the PDF SHA-256. No cryptographic PDF document signature is asserted."
  },
  "license": {
    "identifier": "CC0-1.0",
    "application": "Authored material only; third-party material retains its own rights.",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb"
  },
  "content": {
    "text": "Contents · Live article\n\nFollow-up · Empire, Roll and Fast / SIH\nFOLLOW-UP / 10 OCTOBER 2026\nEmpire’s session access. Fast’s current SIH connection.\n\nThe follow-up examines Trade Token Sync 1.2.4, the background Steam renewal mechanism, old and current Roll availability, and new first-party Fast frontend evidence linking SIH.\n\nRead the new findings ↗\nTECHNICAL APPENDIX / 10 OCTOBER 2026\nSteam sessions. Platform access.\nINVESTIGATION BY AGENT CORA\n\nFollow the credential from the user’s browser to the platform’s control layer.\n\nThe authenticated Steam session is a renewable source of account access. We inspected the package currently linked by CSGORoll and the official SIH download to identify exactly where a token is read, how it leaves the browser, and what triggers another read.\n\nThe author’s audit of this same SIH 2.11.12 specimen — a remotely tasked execution grid over users’ authenticated Steam sessions, with the mass-parsing/Layer-7 abuse-capability question — is retained in full on the case page; this appendix’s code findings are its byte-anchored evidence. The CSGOFast/SIH/Valve case ↗\n\nFollow the code ↓What does “24 hours” mean?\nREVIEW RECORD2 packages.\nExact versions.\nCSGORoll-linked\n1.2 · Google CRX\nSIH\n2.11.12 · Official ZIP\nMethod\nStatic tracing + offline fixtures\nLive accounts used\n0\nDownload evidence record ↗\nTHE CENTRAL FINDING\n\nA token’s expiry can be temporary. The commercial connection can continue. An available Steam session can supply another credential. The code determines whether collection happens when a popup opens, when a server asks, or when an API request fails.\n\nOriginal 11 October edition · complete text →Preserved original wording, alongside the current sections →\n01 / IDENTIFY THE CODE\nThe package matters.\n\nEach result is tied to a downloaded version. The acquisition record preserves URLs, timestamps and SHA-256 hashes.\n\nCSGOROLL’S CURRENT LINK\n\nSteam WebAPI Token Extension 1.2\n\nOffered by Ancient Gaming. The current official redirect ↗ leads here. [A02]\n\nExtension ID\nbdgacfnoihldeemdcbggkgmjgdfcliah\nEntry point\nPopup → index.js → update-token.js\nToken path\nSteam HTML → popup → clipboard\nIntegrity\nCRX3 proofs verified; ID matches signing key\n\nSHA-256\nb3ad7738bd8aa7a7fda1b8db72a51013a002a2bd7a5e85470f3ab1aca038a443\n\nInspect the extraction path ↓\n\nSIH OFFICIAL DOWNLOAD\n\nSteam Inventory Helper 2.11.12\n\nThe publisher’s website supplies this ZIP and identifies RedBoon Limited. The CSGOFast evidence is examined below. [A07]\n\nExtension ID\ncmeakgjggjdlcpncigglobpjbkabhmjl\nEntry point\nservice-worker.js → background bundles\nToken path\nSteam HTML → handler → SIH WebSocket\nIntegrity\nOfficial HTTPS ZIP; file hashes recorded\n\nSHA-256\n63755fe96c0a55826d45661f8aec56a0b173a833ddf0e64074fd5a798425bd6a\n\nA newer SIH 2.12.1 package was separately acquired from Google’s update service and audited on the case page — three CRX3 signatures verified, extension ID matched. This appendix pins 2.11.12; the 33-finding record for 2.12.1 lives with the case. The CSGOFast/SIH/Valve case ↗\n\nInspect the server-message path ↓\n02 / FOLLOW THE LOGIC\nThe session is the starting point.\n\nThese are reconstructed code paths. They show the downloaded client’s logic, with the conditions needed to reach each step.\n\nTRIGGERUser opens the extension popup.R03 ↗\n01\nUse the existing login\n\nThe extension requests steamcommunity.com/profiles with credentials: 'include'. The browser supplies the eligible Steam session cookies.\n\n02\nRead Steam’s response\n\nIt extracts the SteamID and data-loyalty_webapi_token from HTML. The value is the live, Steam-issued session credential — account-session material the platform cannot read without the user’s browser.\n\n03\nHand the value to the user\n\nThe popup displays the token. A click copies it to the clipboard. Version 1.2 has no registered background worker or automatic platform-upload code.\n\n04\nComplete the platform handoff\n\nCSGORoll’s help instructions tell the user to paste the copied token into its inventory page. That website-side submission is the next step, outside this extension’s code. [A06]\n\nCONTROL CONSEQUENCE\n\nThe user’s Steam login makes a transferable account credential available for the platform’s verification workflow.\n\nTRIGGERA matching message arrives on the active SIH connection.S02 ↗\n01\nStart the eligible background connection\n\nThe runner checks its market setting and stored Steam authorization. Controller state also depends on configuration and orders. The destination is wss-new.steaminventoryhelper.com. [S03]\n\n02\nDispatch the server message\n\nThe active handler map connects the token-request event to Db. The handler requests steamcommunity.com/id/me/edit/info.\n\n03\nExtract the credential\n\nIt matches the loyalty WebAPI token in the response. This handler can proceed only if the request returns the expected authenticated page and token field.\n\n04\nReturn it over the same connection\n\nThe value enters the response’s webApiToken field, alongside the request’s message ID. The send operation uses the SIH WebSocket provider.\n\nCONTROL CONSEQUENCE\n\nThe client includes a server-requested credential handoff. The server chooses when to ask; production requests were not captured in the 10 October static audit.\n\nNo game-developer account is needed for the extraction path.\n\nThis code begins with a user logged into Steam Community. “WebAPI token” names account-session material exposed in that user’s response. It is a different access route from a Steamworks publisher key. The main investigation’s three-column comparison explains those access types.\n\nRead the original 11 October wording\n\nPreserved verbatim from the supplied 11 October 2026 edition. “Today” and “currently” refer to that edition; its original estimates and formulations remain available alongside the dated text above.\n\nThe client includes a server-requested credential handoff. The server chooses when to ask; actual production requests were not captured in this review.\n\nOpen this passage in the complete original edition →\n03 / THE 24-HOUR QUESTION\nValidity and collection have separate triggers.\n\nA token’s exp value describes its validity deadline. A timer, popup action, failed request or server message determines when the client asks for a token again.\n\nWhat the reviewed evidence establishes\nMechanism\tTrigger\tObserved evidence\nCSGORoll · April 2024 instructions\tDaily renewal\tThe operator instructs users to obtain the token in the same logged-in Steam session and renew it daily. [A04]\nCSGORoll · June 2024 announcement\tAutomatic collection and refresh\tThe announcement describes background collection and transmission to its servers. The earlier package was not acquired for code inspection. CSGORoll should release the 2024 package that performed the announced automatic collection, together with its collection logs. [A05]\nCurrent linked extension · 1.2\tPopup opens\tThe inspected entry point reads the profile token. There is no scheduled 24-hour renewal in this registered path. [R02–R03]\nSIH · token-request handler\tServer message\tThe active handler can extract and return a token on request. The production request cadence is server-side. [S02]\nSIH · trade API recovery\tHTTP 403 response\tReread profile → extract token → update storage → retry. A profile-cache threshold of 60 seconds is separate from token validity. [S04]\nSIH · authenticator subsystem\tExpiry check / explicit refresh call\tA separate path uses a refresh token and SteamID to request a Steam-issued access token. [S05]\nWHAT REPEATS\n\nThe client reacquires a credential from Steam. A repeated request may return the same token until Steam rotates it. Continued account access is the condition that makes renewal possible. The audit did not measure a universal 86,400-second lifetime.\n\n04 / BEYOND READING A TOKEN\nThe active SIH agent also handles trade commands.\n\nThe registered background map contains send, accept, decline and cancel handlers. In the send path, the extension constructs an offer, supplies session material and submits it to Steam. [S06]\n\nSERVER INPUT\nRecipient. Items. Trade message.\n\nThe request payload supplies the intended recipient and offer contents.\n\nBROWSER AUTHORITY\nSession ID. Steam cookies.\n\nThe client adds session material and sends the request through the authenticated browser context.\n\nSERVER FEEDBACK\nResult. Steam trade ID.\n\nThe result is returned to the connected server for its workflow.\n\nThe authority here comes from the extension’s browser access and session-backed requests. Steam’s account restrictions and any required mobile confirmation remain part of execution. The audit did not perform a trade.\n\nThe session-backed submissions documented here are received by Steam as account-authenticated requests: operator instructions running through user accounts land on Valve’s own endpoints and controls. The CSGOFast/SIH/Valve case ↗\n\nDirect item delivery still sits inside a controlled process.\n\nCredential collection, delivery verification and balance release are distinct steps. The main investigation documents the platform’s settlement rules. The code audit identifies the access mechanisms that can connect a user’s Steam activity to that platform workflow.\n\n05 / CSGOFAST ATTRIBUTION\nWhat is actually inside the SIH package?\n\nFOUND IN THE DISTRIBUTED FILES\n\n“CSGOFast: Confirm trade”\n\nbundle/js/sihAgent.js contains this notification and a send-trade branch. The current background bundle also contains CSGOFast promotional references. [F01]\n\nCURRENT REGISTRATION\n\nThe service worker loads background.js. A package-wide text search found no reference loading sihAgent.js. The active token handler traced here belongs to SIH.\n\nThe follow-up now supplies current first-party evidence: CSGOFast’s frontend links the SIH extension and checks its online/permission state. That establishes the present frontend integration. The older bundled CSGOFast branch remains shipped inside the distributed package; CSGOFast’s own frontend establishes the same connection today. Read the current Fast integration findings ↗\n\n06 / REPRODUCIBLE LOCATIONS\nEvery finding has a file behind it.\n\nOpen a finding for its original file hash, line and byte offset. Optional formatted lines use jsbeautifier 1.15.4; original byte offsets remain the stable reference.\n\nEvidence JSON ↗English report ↗\nR01The current CSGORoll link identifies a different packageAcquisition record\n\nOn 10 October 2026, https://csgoroll.com/extension resolved to Steam WebAPI Token Extension, ID bdgacfnoihldeemdcbggkgmjgdfcliah, offered by Ancient Gaming. The Google update service supplied version 1.2. The June 2024 blog links to the earlier ID cgkgfnlnpcifjnbfdbmcphcgnkeinjpd. The two package identities are recorded separately.\n\ncsgoroll-current / manifest.json\n\nOriginal line 3 · byte 174\n\nFind: \"version\":\"1.2\"\n\nSHA-256 ab2ff2f51b5b1ebc862085e992ea380cfb9c42c837fd74c3e9657d9a57eeb792\n\nR02The browser session supplies the tokenCode + offline check\n\nOpening the popup loads index.js, which calls getSteamCommunityInfo(). That function requests https://steamcommunity.com/profiles with credentials included, extracts the SteamID and data-loyalty_webapi_token from the returned HTML, and returns both. It reads a Steam-issued value. An offline fixture confirmed that the same response produces the same token.\n\ncsgoroll-current / index.html\n\nOriginal line 51 · byte 1,908\n\nFind: <script src=\"index.js\"\n\nSHA-256 93351ab1c5ac5bcd7b6aae5a7ce6bb7bd7c4f6d0a1e7b8322483c218c2a6bf71\n\ncsgoroll-current / index.js\n\nOriginal line 4 · byte 134 · formatted 5–9\n\nFind: getSteamCommunityInfo().then\n\nSHA-256 b1d899ebd09894ae26d886e67799e724fe4347fc14bc6561074c90531c9d5c73\n\ncsgoroll-current / update-token.js\n\nOriginal line 2 · byte 63 · formatted 1–37\n\nFind: getSteamCommunityInfo\n\nSHA-256 a5377f3cc9131c6b9a8d7f3c15268ccc51053bc153310634f3ddda8d059365fc\n\nR03Version 1.2 is a popup-and-clipboard pathRegistered code path\n\nThe token is displayed in the popup and copied when the user clicks the copy button. The manifest declares no background worker, no alarms permission and no content scripts. The registered JavaScript contains no daily refresh scheduler or automatic platform upload. CSGORoll’s current help page completes this route with a manual paste into its token field. A separate React template bundle is shipped but is not registered or imported by this entry path.\n\ncsgoroll-current / manifest.json\n\nOriginal line 3 · byte 417\n\nFind: \"permissions\":[]\n\nSHA-256 ab2ff2f51b5b1ebc862085e992ea380cfb9c42c837fd74c3e9657d9a57eeb792\n\ncsgoroll-current / index.js\n\nOriginal line 33 · byte 1,273 · formatted 33–44\n\nFind: navigator.clipboard\n\nSHA-256 b1d899ebd09894ae26d886e67799e724fe4347fc14bc6561074c90531c9d5c73\n\nS01SIH runs a privileged background componentManifest + entry point\n\nThe official SIH ZIP identifies version 2.11.12. Its service worker imports common.js, background.js and backgroundAngular.js. Its declared capabilities include cookies, storage, webRequest and declarativeNetRequest, with host access to all URLs. The manifest’s complete permission list is notifications, alarms, storage, unlimitedStorage, background, webRequest, declarativeNetRequest, declarativeNetRequestFeedback, cookies, activeTab and management, beside host access to <all_urls>. Those permissions describe available capabilities; the following findings trace specific uses.\n\nsih / manifest.json\n\nOriginal line 7 · byte 164\n\nFind: \"version\": \"2.11.12\"\n\nSHA-256 d9cd8006b8cfb634943c44c540cf5db9ea425af2a59c8b0def2a8bcdef442379\n\nsih / manifest.json\n\nOriginal line 446 · byte 14,563\n\nFind: \"permissions\"\n\nSHA-256 d9cd8006b8cfb634943c44c540cf5db9ea425af2a59c8b0def2a8bcdef442379\n\nsih / service-worker.js\n\nOriginal line 11 · byte 393\n\nFind: importScripts\n\nSHA-256 03bc8f4d0ab34af3d93c0245ebb58a680b06443348473ea36d87cb975a48b64c\n\nS02A server message can request a WebAPI tokenRegistered handler\n\nIn the active background bundle, event Av maps to handler Db. Db requests the Steam profile-edit page, extracts its loyalty WebAPI token, and places the value in a webApiToken response field. The handler map is attached to a WebSocket provider at wss://wss-new.steaminventoryhelper.com. This is a code path for returning a credential to the server when extraction succeeds; this review did not capture a live authenticated exchange.\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 532,222 · formatted 22,939–22,954\n\nFind: Av=\"vYPRqjhY88H91uTxrcm\"\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 723,214 · formatted 32,324–32,354\n\nFind: Webapi token get: called\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 1,210,623 · formatted 56,880–56,880\n\nFind: Av,Db\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 1,212,415 · formatted 56,933–56,976\n\nFind: wss://wss-new.steaminventoryhelper.com\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nS03The connection has explicit operating conditionsControl flow\n\nThe agent runner checks the sih_app_market_toggle setting and stored Steam authorization before connecting. Its controller also considers server configuration, eligible account cohorts and pending orders. The token handler itself contains no additional project-permission check or per-request confirmation. Server-side authorization and which commands are actually sent remain outside the downloaded client package — the command log and authorization configuration are the operator’s records, and SIH should disclose them.\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 513,763 · formatted 22,093–22,115\n\nFind: e[this.settingName]&&r\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 1,224,236 · formatted 57,525–57,581\n\nFind: h=f.AVAILABLE_CONTROLLER_LAST_NUMBER_IDS,p=l&&l.steamId\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nS04Trade reads can recover by rereading the profileCode path\n\nSIH stores a webApiToken and supplies it as access_token to IEconService/GetTradeOffers. Its HTTP 403 branch obtains the profile again, extracts a token, updates storage and retries. The shared profile helper has a 60-second cache threshold. These are response-driven and cache-driven mechanisms; this path contains no fixed 24-hour token-renewal timer.\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 328,760 · formatted 12,621–12,679\n\nFind: Date.now()-Vc.ts>=6e4\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 665,071 · formatted 29,396–29,459\n\nFind: Not available web api\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/common.js\n\nOriginal line 1 · byte 204,323\n\nFind: data-loyalty_webapi_token\n\nSHA-256 f1cfa4c20bef835cb0f0e73445077df9ca103f4bd7ed9bd2f8fad602322b0e8c\n\nS05Refresh-token renewal is a separate implementationSeparate credential path\n\nSIH also contains an authenticator/session-management subsystem. It checks an access token’s exp claim and can request another access token from Steam’s GenerateAccessTokenForApp endpoint using a refresh token and SteamID. This subsystem requires its own session material; the profile-page token extraction path does not itself establish possession of a refresh token.\n\nsih / bundle/js/background.js\n\nOriginal line 17 · byte 1,483,401 · formatted 69,444–69,457\n\nFind: isTokenExpired error:\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 17 · byte 1,483,633 · formatted 69,458–69,523\n\nFind: refresh_token:e,steamid:r\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nS06The active agent includes trade execution pathsRegistered handlers\n\nThe same active handler map registers send, accept, decline and cancel operations. The send path constructs an offer from the payload’s recipient and items, adds the local Steam session ID and recipient trade-link token, and POSTs to Steam with credentials included. The server receives the resulting trade ID. Actual execution remains subject to the active session, agent state and Steam’s checks; final mobile confirmation was not tested.\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 531,972 · formatted 22,939–22,947\n\nFind: dv=\"tradesend\"\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 1,199,292 · formatted 56,297–56,329\n\nFind: https://steamcommunity.com/tradeoffer/new/send\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 1,201,080 · formatted 56,397–56,408\n\nFind: partner:s.data.recipient.steamId\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nsih / bundle/js/background.js\n\nOriginal line 1 · byte 1,209,217 · formatted 56,806–56,825\n\nFind: Trade send: called\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\nF01What the package establishes about CSGOFastAttribution boundary\n\nThe SIH package contains a CSGOFast-labelled notification and send-trade implementation in bundle/js/sihAgent.js, plus CSGOFast promotional references in the active background bundle. A package-wide text search found no registration or import reference to sihAgent.js. The active credential path above belongs to SIH. The current CSGOFast frontend supplies the additional connection evidence: a direct SIH installation link and checks for its online and permission state. This establishes the integration at the frontend; what the backend commands do and who controls the operation are records in SIH’s and CSGOFast’s possession, and both operators should publish them. Inspect the new first-party evidence ↗\n\nsih / bundle/js/sihAgent.js\n\nOriginal line 1 · byte 364,333 · formatted 14,343–14,422\n\nFind: CSGOFast: Confirm trade\n\nSHA-256 3071af198f4b6f88580971b135728a600b06b5d9ae27e44cdc07a0ecf233406c\n\nsih / bundle/js/background.js\n\nOriginal line 17 · byte 2,273,840\n\nFind: key:\"CSGOFAST\"\n\nSHA-256 dffbdddffe00b8d3cbc77fd1963ce25a4513af535e92b951c9df0a5333c69c36\n\n07 / REVIEW METHOD\nPinned artifacts. Bounded conclusions.\nCompleted\nOfficial referral and download provenance recorded.\nPackage versions and original file SHA-256 hashes captured.\nCurrent CRX signatures checked, including the extension-ID key match.\nRegistered entry points and selected credential/trade paths traced.\nOriginal CSGORoll extractor run offline against synthetic fixtures: five checks passed.\nNot measured\nSteam’s live token lifetime and rotation cadence.\nWhich messages SIH’s production server sent during the 10 October static audit.\nActual account permissions, mobile confirmations or settlement outcomes.\nRuntime behavior of the earlier CSGORoll package and Fast’s authenticated SIH integration.\nEvery SIH feature or every one of its 225 JavaScript files.\n\nThis is a targeted code audit, not a certification of either extension. No browser profile, live token or Steam account was used. No extension was installed. The small offline harness intercepts every request and uses invented input.\n\nThe separate 11 October runtime capture of SIH 2.11.12 records the live connection, controller settings, uploads, advertising and OpenID flow. The version ledger connects that capture with this static audit and the signed 2.12.1 follow-up.\n\nRead the original 11 October wording\n\nPreserved verbatim from the supplied 11 October 2026 edition. “Today” and “currently” refer to that edition; its original estimates and formulations remain available alongside the dated text above.\n\nWhich messages SIH’s production server currently sends.\n\nOpen this passage in the complete original edition →\n08 / PRIMARY RECORDS\nSources and downloads.\nA01\nCSGORoll’s current extension redirect ↗\n\nObserved final URL and timestamp are retained in the audit record.\n\nA02\nSteam WebAPI Token Extension — Chrome Web Store ↗\n\nVersion 1.2; Ancient Gaming; listed update 22 February 2025.\n\nA03\nCurrent CRX from Google’s update service ↗\n\nDownloaded package, SHA-256 and signature checks pinned in this report.\n\nA04\nCSGORoll — WebAPI P2P Solution ↗\n\n10 April 2024. Same-session token extraction and daily renewal instruction.\n\nA05\nCSGORoll — WebAPI Trading Extension ↗\n\n25 June 2024. Automatic collection, refresh and transmission in the announced workflow.\n\nA06\nCSGORoll Help Center — Steam WebAPI Token ↗\n\n10 November 2025. Extension copy-and-paste instructions and trade-status use.\n\nA07\nSIH official download page ↗\n\nThe page links directly to the audited ZIP and identifies RedBoon Limited.\n\nA08\nSIH official ZIP ↗\n\nDownloaded version 2.11.12. This is the audit’s SIH code source.\n\nA09\nSIH — Chrome Web Store ↗\n\nPublished identity and version cross-check.\n\nA10\nChromium — CRX3 format ↗\n\nSigned archive layout and extension-ID derivation.\n\nA11\nChrome — cross-origin network requests ↗\n\nExtension host permissions and cross-origin request behavior. Host-permission paths do not constrain access to just that path.\n\nA12\nChrome — cookies API ↗\n\nCookie access requires the cookies permission and matching host permissions.\n\nA13\nChrome — alarms API ↗\n\nA scheduled callback interval is distinct from the expiry encoded in a token.\n\nCSGORoll-linked manifest ↗SIH manifest ↗Signature results ↗Offline check results ↗",
    "headings": [
      {
        "level": 3,
        "text": "Empire’s session access. Fast’s current SIH connection.",
        "anchor": "pd-extension-audit--heading-1",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#new-session-evidence"
      },
      {
        "level": 1,
        "text": "Steam sessions. Platform access.",
        "anchor": "pd-extension-audit--heading-2",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#overview"
      },
      {
        "level": 2,
        "text": "The package matters.",
        "anchor": "pd-extension-audit--heading-3",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#packages"
      },
      {
        "level": 3,
        "text": "Steam WebAPI Token Extension 1.2",
        "anchor": "pd-extension-audit--heading-4",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#packages"
      },
      {
        "level": 3,
        "text": "Steam Inventory Helper 2.11.12",
        "anchor": "pd-extension-audit--heading-5",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#packages"
      },
      {
        "level": 2,
        "text": "The session is the starting point.",
        "anchor": "pd-extension-audit--heading-6",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#traces"
      },
      {
        "level": 3,
        "text": "Use the existing login",
        "anchor": "pd-extension-audit--heading-7",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-roll"
      },
      {
        "level": 3,
        "text": "Read Steam’s response",
        "anchor": "pd-extension-audit--heading-8",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-roll"
      },
      {
        "level": 3,
        "text": "Hand the value to the user",
        "anchor": "pd-extension-audit--heading-9",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-roll"
      },
      {
        "level": 3,
        "text": "Complete the platform handoff",
        "anchor": "pd-extension-audit--heading-10",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-roll"
      },
      {
        "level": 3,
        "text": "Start the eligible background connection",
        "anchor": "pd-extension-audit--heading-11",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-sih"
      },
      {
        "level": 3,
        "text": "Dispatch the server message",
        "anchor": "pd-extension-audit--heading-12",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-sih"
      },
      {
        "level": 3,
        "text": "Extract the credential",
        "anchor": "pd-extension-audit--heading-13",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-sih"
      },
      {
        "level": 3,
        "text": "Return it over the same connection",
        "anchor": "pd-extension-audit--heading-14",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trace-sih"
      },
      {
        "level": 3,
        "text": "No game-developer account is needed for the extraction path.",
        "anchor": "pd-extension-audit--heading-15",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#traces"
      },
      {
        "level": 2,
        "text": "Validity and collection have separate triggers.",
        "anchor": "pd-extension-audit--heading-16",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#timing"
      },
      {
        "level": 2,
        "text": "The active SIH agent also handles trade commands.",
        "anchor": "pd-extension-audit--heading-17",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trade-control"
      },
      {
        "level": 3,
        "text": "Recipient. Items. Trade message.",
        "anchor": "pd-extension-audit--heading-18",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trade-control"
      },
      {
        "level": 3,
        "text": "Session ID. Steam cookies.",
        "anchor": "pd-extension-audit--heading-19",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trade-control"
      },
      {
        "level": 3,
        "text": "Result. Steam trade ID.",
        "anchor": "pd-extension-audit--heading-20",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trade-control"
      },
      {
        "level": 3,
        "text": "Direct item delivery still sits inside a controlled process.",
        "anchor": "pd-extension-audit--heading-21",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#trade-control"
      },
      {
        "level": 2,
        "text": "What is actually inside the SIH package?",
        "anchor": "pd-extension-audit--heading-22",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#csgofast"
      },
      {
        "level": 3,
        "text": "“CSGOFast: Confirm trade”",
        "anchor": "pd-extension-audit--heading-23",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#csgofast"
      },
      {
        "level": 2,
        "text": "Every finding has a file behind it.",
        "anchor": "pd-extension-audit--heading-24",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#code-record"
      },
      {
        "level": 2,
        "text": "Pinned artifacts. Bounded conclusions.",
        "anchor": "pd-extension-audit--heading-25",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#method"
      },
      {
        "level": 3,
        "text": "Completed",
        "anchor": "pd-extension-audit--heading-26",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#method"
      },
      {
        "level": 3,
        "text": "Not measured",
        "anchor": "pd-extension-audit--heading-27",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#method"
      },
      {
        "level": 2,
        "text": "Sources and downloads.",
        "anchor": "pd-extension-audit--heading-28",
        "source_url": "https://phishdestroy.io/steam_dossier/extension-audit#sources"
      }
    ],
    "links": [
      {
        "label": "Live article",
        "url": "https://phishdestroy.io/steam_dossier/extension-audit"
      },
      {
        "label": "Read the new findings ↗",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking.html"
      },
      {
        "label": "The CSGOFast/SIH/Valve case ↗",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html"
      },
      {
        "label": "Download evidence record ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-record.json"
      },
      {
        "label": "Original 11 October edition · complete text →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/extension-audit.html"
      },
      {
        "label": "official redirect ↗",
        "url": "https://csgoroll.com/extension"
      },
      {
        "label": "The CSGOFast/SIH/Valve case ↗",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html"
      },
      {
        "label": "three-column comparison",
        "url": "https://phishdestroy.io/steam_dossier/steam-access.html#credentials"
      },
      {
        "label": "Open this passage in the complete original edition →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/extension-audit.html#traces"
      },
      {
        "label": "The CSGOFast/SIH/Valve case ↗",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html"
      },
      {
        "label": "the platform’s settlement rules",
        "url": "https://phishdestroy.io/steam_dossier/gambling-system.html#settlement-rules"
      },
      {
        "label": "Read the current Fast integration findings ↗",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking.html#fast"
      },
      {
        "label": "Evidence JSON ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-record.json"
      },
      {
        "label": "English report ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-report.md"
      },
      {
        "label": "Inspect the new first-party evidence ↗",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking.html#fast"
      },
      {
        "label": "11 October runtime capture of SIH 2.11.12",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html#runtime-capture"
      },
      {
        "label": "version ledger",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html#evidence-versions"
      },
      {
        "label": "Open this passage in the complete original edition →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/extension-audit.html#method"
      },
      {
        "label": "CSGORoll’s current extension redirect ↗",
        "url": "https://csgoroll.com/extension"
      },
      {
        "label": "Steam WebAPI Token Extension — Chrome Web Store ↗",
        "url": "https://chromewebstore.google.com/detail/steam-webapi-token-extens/bdgacfnoihldeemdcbggkgmjgdfcliah"
      },
      {
        "label": "Current CRX from Google’s update service ↗",
        "url": "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=140.0.0.0&acceptformat=crx2%2Ccrx3&x=id%3Dbdgacfnoihldeemdcbggkgmjgdfcliah%26uc"
      },
      {
        "label": "CSGORoll — WebAPI P2P Solution ↗",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "CSGORoll — WebAPI Trading Extension ↗",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "CSGORoll Help Center — Steam WebAPI Token ↗",
        "url": "https://intercom.help/csgoroll/en/articles/12033745-steam-webapi-token"
      },
      {
        "label": "SIH official download page ↗",
        "url": "https://steaminventoryhelper.com/"
      },
      {
        "label": "SIH official ZIP ↗",
        "url": "https://download.steaminventoryhelper.com/chrome-extension.zip"
      },
      {
        "label": "SIH — Chrome Web Store ↗",
        "url": "https://chromewebstore.google.com/detail/steam-inventory-helper/cmeakgjggjdlcpncigglobpjbkabhmjl"
      },
      {
        "label": "Chromium — CRX3 format ↗",
        "url": "https://raw.githubusercontent.com/chromium/chromium/main/components/crx_file/crx3.proto"
      },
      {
        "label": "Chrome — cross-origin network requests ↗",
        "url": "https://developer.chrome.com/docs/extensions/develop/concepts/network-requests"
      },
      {
        "label": "Chrome — cookies API ↗",
        "url": "https://developer.chrome.com/docs/extensions/reference/api/cookies"
      },
      {
        "label": "Chrome — alarms API ↗",
        "url": "https://developer.chrome.com/docs/extensions/reference/api/alarms"
      },
      {
        "label": "CSGORoll-linked manifest ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/csgoroll-manifest.json"
      },
      {
        "label": "SIH manifest ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/sih-manifest.json"
      },
      {
        "label": "Signature results ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/crx-verification.json"
      },
      {
        "label": "Offline check results ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/offline-checks.json"
      }
    ],
    "tables": [
      {
        "id": "table-1",
        "caption": "What the reviewed evidence establishes",
        "rows": [
          [
            "Mechanism",
            "Trigger",
            "Observed evidence"
          ],
          [
            "CSGORoll · April 2024 instructions",
            "Daily renewal",
            "The operator instructs users to obtain the token in the same logged-in Steam session and renew it daily. [A04]"
          ],
          [
            "CSGORoll · June 2024 announcement",
            "Automatic collection and refresh",
            "The announcement describes background collection and transmission to its servers. The earlier package was not acquired for code inspection. CSGORoll should release the 2024 package that performed the announced automatic collection, together with its collection logs. [A05]"
          ],
          [
            "Current linked extension · 1.2",
            "Popup opens",
            "The inspected entry point reads the profile token. There is no scheduled 24-hour renewal in this registered path. [R02–R03]"
          ],
          [
            "SIH · token-request handler",
            "Server message",
            "The active handler can extract and return a token on request. The production request cadence is server-side. [S02]"
          ],
          [
            "SIH · trade API recovery",
            "HTTP 403 response",
            "Reread profile → extract token → update storage → retry. A profile-cache threshold of 60 seconds is separate from token validity. [S04]"
          ],
          [
            "SIH · authenticator subsystem",
            "Expiry check / explicit refresh call",
            "A separate path uses a refresh token and SteamID to request a Steam-issued access token. [S05]"
          ]
        ]
      }
    ],
    "cited_source_ids": []
  },
  "resources": [
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-record.json",
      "sha256": "4e3d019401d3a31657cf6257fed90eda1cf2aa239aa15a9d594cbb7207f37fa8",
      "bytes": 26708
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/csgoroll-manifest.json",
      "sha256": "54fc384be1c1da10ec433da4bf0513e33d58628835f645272e6607df736b4546",
      "bytes": 740
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/sih-manifest.json",
      "sha256": "1c8c25240f14c8e9fd40df3272c24f0a3cff2af0823088dd60c6bbc285a9b74e",
      "bytes": 18170
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/crx-verification.json",
      "sha256": "39cf0db605cb77c9f803fc704abdcef5fe0d196cd1a112a15e8d527118f3fac9",
      "bytes": 1057
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/offline-checks.json",
      "sha256": "257d7177c979cf01f1296ee2a491c8c97ed79940973f6bc43fbdb071382af0d4",
      "bytes": 495
    }
  ]
}