# Steam sessions. Platform access. Canonical: https://phishdestroy.io/steam_dossier/extension-audit Language: en Author: Agent Cora Publisher: PhishDestroy Published: 11 October 2026 FOLLOW-UP / 10 OCTOBER 2026 ### Empire’s session access. Fast’s current SIH connection. The follow-up examines Trade Token Sync 1.2.4, the background Steam renewal mechanism, old and current Roll availability, and new first-party Fast frontend evidence linking SIH. [Read the new findings ↗](https://phishdestroy.io/steam_dossier/trade-tracking.html) TECHNICAL APPENDIX / 10 OCTOBER 2026 Follow the credential from the user’s browser to the platform’s control layer. The authenticated Steam session is a renewable source of account access. We inspected the package currently linked by CSGORoll and the official SIH download to identify exactly where a token is read, how it leaves the browser, and what triggers another read. The author’s audit of this same SIH 2.11.12 specimen — a remotely tasked execution grid over users’ authenticated Steam sessions, with the mass-parsing/Layer-7 abuse-capability question — is retained in full on the case page; this appendix’s code findings are its byte-anchored evidence. [The CSGOFast/SIH/Valve case ↗](https://phishdestroy.io/steam_dossier/csgofast-sih.html) [Follow the code ↓](https://phishdestroy.io/steam_dossier/extension-audit#traces) [What does “24 hours” mean?](https://phishdestroy.io/steam_dossier/extension-audit#timing) REVIEW RECORD **2 packages. Exact versions.** CSGORoll-linked 1.2 · Google CRX SIH 2.11.12 · Official ZIP Method Static tracing + offline fixtures Live accounts used 0 [Download evidence record ↗](https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-record.json) THE CENTRAL FINDING **A token’s expiry can be temporary. The commercial connection can continue.** An available Steam session can supply another credential. The code determines whether collection happens when a popup opens, when a server asks, or when an API request fails. 01 / IDENTIFY THE CODE ## The package matters. Each result is tied to a downloaded version. The acquisition record preserves URLs, timestamps and SHA-256 hashes. CSGOROLL’S CURRENT LINK ### Steam WebAPI Token Extension *1.2* Offered by Ancient Gaming. The current [official redirect ↗](https://csgoroll.com/extension) leads here. [A02](https://phishdestroy.io/steam_dossier/extension-audit#A02) Extension ID bdgacfnoihldeemdcbggkgmjgdfcliah Entry point Popup → index.js → update-token.js Token path Steam HTML → popup → clipboard Integrity CRX3 proofs verified; ID matches signing key SHA-256 b3ad7738bd8aa7a7fda1b8db72a51013a002a2bd7a5e85470f3ab1aca038a443 [Inspect the extraction path ↓](https://phishdestroy.io/steam_dossier/extension-audit#R02) SIH OFFICIAL DOWNLOAD ### Steam Inventory Helper *2.11.12* The publisher’s website supplies this ZIP and identifies RedBoon Limited. The CSGOFast evidence is examined [below](https://phishdestroy.io/steam_dossier/extension-audit#csgofast) . [A07](https://phishdestroy.io/steam_dossier/extension-audit#A07) Extension ID cmeakgjggjdlcpncigglobpjbkabhmjl Entry point service-worker.js → background bundles Token path Steam HTML → handler → SIH WebSocket Integrity Official HTTPS ZIP; file hashes recorded SHA-256 63755fe96c0a55826d45661f8aec56a0b173a833ddf0e64074fd5a798425bd6a A newer SIH 2.12.1 package was separately acquired from Google’s update service and audited on the case page — three CRX3 signatures verified, extension ID matched. This appendix pins 2.11.12; the 33-finding record for 2.12.1 lives with the case. [The CSGOFast/SIH/Valve case ↗](https://phishdestroy.io/steam_dossier/csgofast-sih.html) [Inspect the server-message path ↓](https://phishdestroy.io/steam_dossier/extension-audit#S02) 02 / FOLLOW THE LOGIC ## The session is the starting point. These are reconstructed code paths. They show the downloaded client’s logic, with the conditions needed to reach each step. CSGORoll-linked · 1.2 SIH · 2.11.12 TRIGGER **User opens the extension popup.** [R03 ↗](https://phishdestroy.io/steam_dossier/extension-audit#R03) 1. 01 ### Use the existing login The extension requests `steamcommunity.com/profiles` with `credentials: 'include'`. The browser supplies the eligible Steam session cookies. 2. 02 ### Read Steam’s response It extracts the SteamID and `data-loyalty_webapi_token` from HTML. The value is the live, Steam-issued session credential — account-session material the platform cannot read without the user’s browser. 3. 03 ### Hand the value to the user The popup displays the token. A click copies it to the clipboard. Version 1.2 has no registered background worker or automatic platform-upload code. 4. 04 ### Complete the platform handoff CSGORoll’s help instructions tell the user to paste the copied token into its inventory page. That website-side submission is the next step, outside this extension’s code. [A06](https://phishdestroy.io/steam_dossier/extension-audit#A06) CONTROL CONSEQUENCE The user’s Steam login makes a transferable account credential available for the platform’s verification workflow. TRIGGER **A matching message arrives on the active SIH connection.** [S02 ↗](https://phishdestroy.io/steam_dossier/extension-audit#S02) 1. 01 ### Start the eligible background connection The runner checks its market setting and stored Steam authorization. Controller state also depends on configuration and orders. The destination is `wss-new.steaminventoryhelper.com`. [S03](https://phishdestroy.io/steam_dossier/extension-audit#S03) 2. 02 ### Dispatch the server message The active handler map connects the token-request event to `Db`. The handler requests `steamcommunity.com/id/me/edit/info`. 3. 03 ### Extract the credential It matches the loyalty WebAPI token in the response. This handler can proceed only if the request returns the expected authenticated page and token field. 4. 04 ### Return it over the same connection The value enters the response’s `webApiToken` field, alongside the request’s message ID. The send operation uses the SIH WebSocket provider. CONTROL CONSEQUENCE The client includes a server-requested credential handoff. The server chooses when to ask; production requests were not captured in the 10 October static audit. ### No game-developer account is needed for the extraction path. This code begins with a user logged into Steam Community. “WebAPI token” names account-session material exposed in that user’s response. It is a different access route from a Steamworks publisher key. The main investigation’s [three-column comparison](https://phishdestroy.io/steam_dossier/steam-access.html#credentials) explains those access types. 03 / THE 24-HOUR QUESTION ## Validity and collection have separate triggers. A token’s `exp` value describes its validity deadline. A timer, popup action, failed request or server message determines when the client asks for a token again. What the reviewed evidence establishes | Mechanism | Trigger | Observed evidence | | --- | --- | --- | | CSGORoll · April 2024 instructions | Daily renewal | The operator instructs users to obtain the token in the same logged-in Steam session and renew it daily. [A04](https://phishdestroy.io/steam_dossier/extension-audit#A04) | | CSGORoll · June 2024 announcement | Automatic collection and refresh | The announcement describes background collection and transmission to its servers. The earlier package was not acquired for code inspection. CSGORoll should release the 2024 package that performed the announced automatic collection, together with its collection logs. [A05](https://phishdestroy.io/steam_dossier/extension-audit#A05) | | Current linked extension · 1.2 | Popup opens | The inspected entry point reads the profile token. There is no scheduled 24-hour renewal in this registered path. [R02–R03](https://phishdestroy.io/steam_dossier/extension-audit#R02) | | SIH · token-request handler | Server message | The active handler can extract and return a token on request. The production request cadence is server-side. [S02](https://phishdestroy.io/steam_dossier/extension-audit#S02) | | SIH · trade API recovery | HTTP 403 response | Reread profile → extract token → update storage → retry. A profile-cache threshold of 60 seconds is separate from token validity. [S04](https://phishdestroy.io/steam_dossier/extension-audit#S04) | | SIH · authenticator subsystem | Expiry check / explicit refresh call | A separate path uses a refresh token and SteamID to request a Steam-issued access token. [S05](https://phishdestroy.io/steam_dossier/extension-audit#S05) | WHAT REPEATS **The client reacquires a credential from Steam.** A repeated request may return the same token until Steam rotates it. Continued account access is the condition that makes renewal possible. The audit did not measure a universal 86,400-second lifetime. 04 / BEYOND READING A TOKEN ## The active SIH agent also handles trade commands. The registered background map contains send, accept, decline and cancel handlers. In the send path, the extension constructs an offer, supplies session material and submits it to Steam. [S06](https://phishdestroy.io/steam_dossier/extension-audit#S06) SERVER INPUT ### Recipient. Items. Trade message. The request payload supplies the intended recipient and offer contents. BROWSER AUTHORITY ### Session ID. Steam cookies. The client adds session material and sends the request through the authenticated browser context. SERVER FEEDBACK ### Result. Steam trade ID. The result is returned to the connected server for its workflow. The authority here comes from the extension’s browser access and session-backed requests. Steam’s account restrictions and any required mobile confirmation remain part of execution. The audit did not perform a trade. The session-backed submissions documented here are received by Steam as account-authenticated requests: operator instructions running through user accounts land on Valve’s own endpoints and controls. [The CSGOFast/SIH/Valve case ↗](https://phishdestroy.io/steam_dossier/csgofast-sih.html) ### Direct item delivery still sits inside a controlled process. Credential collection, delivery verification and balance release are distinct steps. The main investigation documents [the platform’s settlement rules](https://phishdestroy.io/steam_dossier/gambling-system.html#settlement-rules) . The code audit identifies the access mechanisms that can connect a user’s Steam activity to that platform workflow. 05 / CSGOFAST ATTRIBUTION ## What is actually inside the SIH package? FOUND IN THE DISTRIBUTED FILES ### “CSGOFast: Confirm trade” `bundle/js/sihAgent.js` contains this notification and a send-trade branch. The current background bundle also contains CSGOFast promotional references. [F01](https://phishdestroy.io/steam_dossier/extension-audit#F01) CURRENT REGISTRATION The service worker loads `background.js`. A package-wide text search found no reference loading `sihAgent.js`. The active token handler traced here belongs to SIH. The follow-up now supplies current first-party evidence: CSGOFast’s frontend links the SIH extension and checks its online/permission state. That establishes the present frontend integration. The older bundled CSGOFast branch remains shipped inside the distributed package; CSGOFast’s own frontend establishes the same connection today. [Read the current Fast integration findings ↗](https://phishdestroy.io/steam_dossier/trade-tracking.html#fast) 06 / REPRODUCIBLE LOCATIONS ## Every finding has a file behind it. Open a finding for its original file hash, line and byte offset. Optional formatted lines use jsbeautifier 1.15.4; original byte offsets remain the stable reference. [Evidence JSON ↗](https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-record.json) [English report ↗](https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/extension-audit-2026-10-10/audit-report.md) **R01 The current CSGORoll link identifies a different package Acquisition record** On 10 October 2026, https://csgoroll.com/extension resolved to Steam WebAPI Token Extension, ID bdgacfnoihldeemdcbggkgmjgdfcliah, offered by Ancient Gaming. The Google update service supplied version 1.2. The June 2024 blog links to the earlier ID cgkgfnlnpcifjnbfdbmcphcgnkeinjpd. The two package identities are recorded separately. csgoroll-current / manifest.json Original line 3 · byte 174 Find: `"version":"1.2"` SHA-256 ab2ff2f51b5b1ebc862085e992ea380cfb9c42c837fd74c3e9657d9a57eeb792 **R02 The browser session supplies the token Code + offline check** Opening the popup loads index.js, which calls getSteamCommunityInfo(). That function requests https://steamcommunity.com/profiles with credentials included, extracts the SteamID and data-loyalty_webapi_token from the returned HTML, and returns both. It reads a Steam-issued value. An offline fixture confirmed that the same response produces the same token. csgoroll-current / index.html Original line 51 · byte 1,908 Find: `