its not the use of tampermonkey, it is using shaddy scripts with it. There’s been so many hacks involving seemly safe tampermonkey scripts that it raises a red flag for a good cause.
oh look,
oaifree(dot)com (do not access this website), sounds legit, right?
Given that this URL is within a tampermonkey script, this is particularly concerning. Tampermonkey scripts can be used to modify or automate interactions with websites, and in this context, it might be used to manipulate or spoof ChatGPT’s user interface for unauthorized purposes. This could be done to bypass rate limits, alter responses, or even steal personal data.
Such scripts and third-party sites often carry privacy and security risks, especially since they may involve rerouting or intercepting data between the user and legitimate platforms. It is advisable to avoid interacting with or using this site, especially if it was associated with suspicious scripts. Ensure that you’re using only official OpenAI channels to interact with ChatGPT for a secure experience.
you can also find these
shaddy urls in vite.config.ts
Potential Issue: Fetching external libraries from CDNs, while convenient, comes with some risks. If the CDN is compromised or if the versions are not properly locked, you could unknowingly include a malicious or tampered version of these libraries.
in api.ts, there is also this:
- Proper sanitization of all user-generated or API-fetched content before insertion into the DOM.
- Secure handling of access tokens and session data.
- Validation of all API responses, especially image and file downloads.
- Implementation of proper Content Security Policies (CSP) to mitigate risks like XSS or data injection.
Now, back to the shaddy URL:
If the oaifree.com domain is a malicious actor, this could allow the script to execute on that site, potentially leading to unauthorized access to sensitive user information (such as their OpenAI session tokens, chat history, or other personal details).
Potential Issue: Userscripts that interact with sensitive pages (like those dealing with user chats or API data) need to ensure they are not exposed to unauthorized or malicious sites. The inclusion of potentially rogue domains like oaifree.com should be carefully scrutinized.
Conclusion:
While a user who only interacts with chat.openai.com may think they are safe, the presence of oaifree.com in both the domain match list and the API URL mappings means that data could be sent to a rogue domain under certain conditions, such as redirection or phishing. To prevent this, it’s essential to:
- Remove any references to
oaifree.com in the code.
- Hardcode trusted API URLs to ensure sensitive data isn’t sent to unauthorized servers.
- Restrict the script’s domain matching to only the official domains you trust.
This will mitigate the risk of information being sent to suspicious third-party domains like oaifree.com.
With this being said, I wouldn’t defend this repository any longer. There’s no good reason to have this shaddy url there. It might seem ok at a naive glance, but it is as simple as hiding some obfuscated code in the UI scripts and all of the sudden your private chat history is getting sent to the backend of this website.
), and while it went closed-source eventually, the developer is confident and transparent enough to even publicly list his phone number on the Tampermonkey web page. If you are worried, just ring him up, and ask, I guess? (
