LastPass - Developer Console Warning Message

  • SpinRite v6.1 Release #3
    The 3rd release of SpinRite v6.1 is published and may be obtained by all SpinRite v6.0 owners at the SpinRite v6.1 Pre-Release page. (SpinRite will shortly be officially updated to v6.1 so this page will be renamed.) The primary new feature, and the reason for this release, was the discovery of memory problems in some systems that were affecting SpinRite's operation. So SpinRite now incorporates a built-in test of the system's memory. For the full story, please see this page in the "Pre-Release Announcements & Feedback" forum.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in please checkout the “Tips & Tricks” page for some very handy tips!

  • BootAble – FreeDOS boot testing freeware

    To obtain direct, low-level access to a system's mass storage drives, SpinRite runs under a GRC-customized version of FreeDOS which has been modified to add compatibility with all file systems. In order to run SpinRite it must first be possible to boot FreeDOS.

    GRC's “BootAble” freeware allows anyone to easily create BIOS-bootable media in order to workout and confirm the details of getting a machine to boot FreeDOS through a BIOS. Once the means of doing that has been determined, the media created by SpinRite can be booted and run in the same way.

    The participants here, who have taken the time to share their knowledge and experience, their successes and some frustrations with booting their computers into FreeDOS, have created a valuable knowledgebase which will benefit everyone who follows.

    You may click on the image to the right to obtain your own copy of BootAble. Then use the knowledge and experience documented here to boot your computer(s) into FreeDOS. And please do not hesitate to ask questions – nowhere else can better answers be found.

    (You may permanently close this reminder with the 'X' in the upper right.)


Jan 4, 2023
I ran the JS snippet to extract my vault yesterday but did not notice the following message that now appears:


This is a feature for developers and researchers! If you are not a developer or researcher, pasting something here could cause your account to be compromised

Perhaps this has always been there, or then again perhaps it's something new...

EDIT: To be clear, this message is generated by a bit of LastPass JS delivered as 'reqaccts_js_bundle'.
Last edited:
The Web Developer console is dangerous if misused, but it has nothing to do with Lastpass. You could get a string messaged to you from a site (email or otherwise) that could, for example, send your Chrome password database to a third party.
  • Like
Reactions: StevenW
Try this to export your data:

If you're running the Lastpass plugin in the browser, click the icon for the plugin in the toolbar at the top. Click account. Click fix a problem yourself. Click export vault items. I don't remember what happens next but it should be pretty obvious.

Hope that helps.

May your bits be stable and your interfaces be fast. :cool: Ron
  • Like
Reactions: SeanBZA
Drops a csv file into the default downloads directory you have, and BW can import it.
Thanks folks. I had no difficulty exporting the vault, I just thought it was interesting that LP put that message in the dev console at some point, and wondered if it was a direct response to either SN904, or Wladimir Palant's original blog post in December. I seem to recall Steve suggesting we should grab the vault as quickly as possible in case LP engineered against the use of the simple JS snippet.

For what it's worth, I'm moving to 1Password since I like the idea of the Secret Key and am happy to pay for what I hope will be good service.
As I said, the message is from the browser itself and NOT from LP.

For example:
No - it only appears in dev consoles opened from an active LastPass session (or even the logon screen).


Following either of these links leads to a JS bundle...


... and in the actual code:

The minified bundle will download from LastPass (parameter not required) e.g.

If you un-minify, you can find the following clause buried in the middle of hundreds of other definitions:


I doubt that the browser is injecting this, and even if it was, what 'account' is it referring to?
Last edited:
Well, it could refer to the account of whatever site you're visiting. Kind of like those scam messages we see everywhere now.
Nah. I'm used to working in the Chrome developer console, and this is the first time I've ever seen the message. Plus all the evidence I already posted.
Facebook does the same thing. Users are told to copy and paste random JavaScript from the internet to "unlock" special features and their account gets taken over.
I think browsers should have a message, sort of like how Firefox has the warning for about:config, at least to use the console. If it weren't for the tech support scammers who will blank your view of the screen to change how things look with your bank account, I'm not sure how to handle the "Don't show again" checkbox. The people who would need to see it are likely the ones who would have that option selected without them ever seeing it because they fell for a tech support scam.