Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Happ Proxy is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by network interception. It comes from a publisher with 26 extensions and was last updated in June 2026.
Key findings
- High
Network Interception
The connection state is held only in service-worker memory and is never read back from the browser: `RELAY_POLL` returns the in-memory `relayActive` and never calls `chrome.proxy.settings.get`, and there is no `chrome.storage` or `chrome.runtime.onStartup` handler anywhere in the bundle. Because `engageTunnel` writes `mode: "fixed_servers"` at `scope: "regular"` (:278-294), that route survives MV3 worker eviction and browser restarts while the popup resets to «Подключить» and reports `active: false`. The user is therefore shown "disconnected" while 100% of non-loopback traffic — the bypass list is loopback-only (:192) — continues to be relayed through the operator's SOCKS5 endpoint, which is the one pattern here that genuinely hides ongoing traffic interception from the user.
- Medium
Unauthorized Data Collection
Every URL the user visits, apart from loopback, is routed to `*.[domain withheld]` over unauthenticated SOCKS5, giving the operator full visibility of the user's complete browsing destinations and of any plaintext traffic. [domain withheld] is first-party (it is the manifest's `homepage_url`), but the CWS listing declares no data collection at all and the privacy policy is an anonymous [domain withheld] page, so a browsing-history-equivalent data category is flowing to the publisher with nothing disclosed under `privacyCollections`. Routing traffic is this extension's stated purpose; the finding is the complete absence of disclosure for the data category it necessarily carries, which is what makes the operator's trustworthiness unverifiable.
Analyst notes
The ~800 readable, unminified lines contain no exfiltration, no remote code loading, no content scripts, no obfuscation and no telemetry — the only network calls are DoH lookups of the operator's own hostname (:224-227), so the ML score of 0.94 is driven by junk features (js_innerhtml:1 is `select.innerHTML=""` at:233; js_appendchild:1 is the option list at:243; everything else is stats), and chrome-stats' clipboard reason is simply wrong (no clipboard permission in the manifest, which matches the published manifest exactly). What keeps this above benign is code-level, not score-level: `relayActive` lives only in worker memory (:3) and `RELAY_POLL` never calls `chrome.proxy.settings.get`, so after MV3 worker eviction or a browser restart the popup reports «Подключить» (disconnected) while the regular-scope `fixed_servers` SOCKS5 route to [domain withheld] keeps carrying all non-loopback traffic; combined with a listing that declares no data collection at all, the user cannot reliably tell when their full browsing stream is being relayed through the operator. The publisher's malicious siblings and the 77%-malware permhash cluster are NOT independent corroboration — the internal note shows this row was labelled by the 2026-09-13 malext-feed import, which is almost certainly the same source behind both counts, so the verdict rests on the code above rather than on those labels. Aggravating context, not findings: are the same endpoint, the premium gate exists only in the popup (:253) while `engageTunnel` accepts any nodeId, "get Premium free" is a hard-coded affiliate referral to an unrelated provider (:195-197), and four unrelated brands (Happ, Авокадо Team, turbotunnel, Myxa) appear in one small template — consistent with a white-label mass-publishing kit.
Happ Proxy Chrome extension security report
ID: plciffedekbipeophpkkjlilcdfnnkic
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- binoyihe32@gmail.com
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://dns.google/*
- 1 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Оптимизированное соединение для комфортного серфинга
Read the publisher’s full description
Happ Proxy — лёгкое browser proxy/VPN-like расширение для Chrome, созданное вокруг идеи позитивного и простого подключения без лишних настроек. Название Happ Proxy отражает характер продукта: быстрый старт, дружелюбный popup и чистый визуальный стиль в неоновой синей, фиолетовой и белой гамме. Расширение помогает управлять proxy-подключением браузера через понятный интерфейс и выбирать доступный сервер для текущей сессии. Основная задача Happ Proxy — дать пользователю удобный способ включить или отключить proxy-подключение прямо из popup-окна. Интерфейс построен так, чтобы всё важное было видно сразу: текущий статус подключения, выбранная локация, кнопка запуска, список доступных серверов и Premium-блок с дополнительными возможностями. Такой подход подходит пользователям, которым нужен максимально лёгкий опыт без сложных сетевых терминов и ручного изменения настроек Chrome.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from binoyihe32@gmail.com
- VPN для ChatGPT - Доступ к GPT из России664 users
- Urban VPN369 users
- Амнезия VPN — лёгкое proxy-подключение для браузера140 users
- Windows VPN90 users
- Happ Plus89 users
Popular in Privacy & Security
- McAfee® WebAdvisor162,000,000 users
- Imprivata Enterprise Access Management20,000,000 users
- Kaspersky Protection19,000,000 users
- VPN for Chrome: NordVPN proxy protection15,000,000 users
- Malwarebytes Browser Guard12,000,000 users