Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Nucleus VPN

CRITICAL RISKRemoved from Chrome Web Store

Nucleus VPN

ID: ffhhkmlgedgcliajaedapkdfigdobcif

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.8.7

Size

1.86 MB

Rating

4.3/5

Reviews

143

Users

387,463

Type

Extension

Updated

Jun 23, 2021

Publisher Contextual Analysis

Author: Helene HillView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

487,463

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Free and unlimited VPN service

Nucleus VPN is a tool that changes your IP address bypassing your traffic through a VPN. By changing your IP address, you can improve your privacy, bypass government restrictions, or access resources that don’t allow you to access them with your IP address. The extension is free and unlimited. We have no premium or paid options at all. Features: ⭐ Free and unlimited ⭐ Choose the country you need ⭐ Fast and reliable connection Unlike many VPN companies, we don’t track your browsing history or sell any data to ad companies.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium3

Low2

Versions scanned

Showing 2 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.8.6 Code review	4
0.8.3 Code review	5

Extension Version	Code Review Findings
0.8.6	4
0.8.3	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js4
bg.js4
popup/popup.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	background.js (line 45)	The extension fetches its entire proxy server list from a remote API endpoint over plain HTTPS with no signature verification, integrity checking, or certificate pinning. Since the extension holds 'proxy' + '<all_urls…	0.8.3
2	Network Interception	high	bg.js (line 6548)	The extension downloads a proxy list from a remote API and then programmatically sets a fixed proxy for the browser. Because it has `proxy` permission and `<all_urls>` access, this gives the operator control over rout…	0.8.6
3	Tracking	high	background.js (line 179)	Once connected, the extension polls https://ifconfig.me/ip every 120 seconds indefinitely. This constitutes continuous, periodic disclosure of the user's proxied IP to a third-party service without user knowledge or c…	0.8.3
4	Unauthorized Data Collection	high	background.js (line 82)	Every proxy health check sends a live request to the third-party service https://ifconfig.me/ip. This leaks the user's current IP address (real or proxied) to ifconfig.me, an external party not disclosed in the extens…	0.8.3
5	Code Injection	medium	bg.js (line 6518)	The background page injects script into every created or updated tab and modifies the DOM of arbitrary pages without user gesture. Here it only inserts a status image, but the pattern is still suspicious because it is…	0.8.6
6	Code Injection	medium	background.js (line 14)	The extension injects dynamically constructed JavaScript code strings into every webpage the user visits via chrome.tabs.executeScript, triggered on both tab creation and every tab update. The injected code string emb…	0.8.3
7	Unauthorized Data Collection	medium	popup/popup.js (line 213)	Every time the user opens the popup, the extension fetches the user's current IP address from https://ifconfig.me/ip and displays it. This sends the user's real IP to a third-party service on every popup open event, e…	0.8.3
8	Tracking	low	bg.js (line 6686)	While connected, the extension repeatedly polls `ifconfig.me` every two minutes to test the proxy path. This creates ongoing background disclosure of the user's network state to a third party and is broader than a one…	0.8.6
9	Unauthorized Data Collection	low	bg.js (line 6586)	The extension validates proxy connectivity by contacting `ifconfig.me`, a third-party service, after changing the browser proxy. This exposes the user's IP and VPN-usage state to an external domain outside the extensi…	0.8.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


npms.io	/search	https://npms.io/search?q=ponyfill.
api.nucleusvpn.com	/api/proxy	https://api.nucleusvpn.com/api/proxy
ifconfig.me	/ip	https://ifconfig.me/ip
fontawesome.io	-	http://fontawesome.io
fontawesome.io	/license	http://fontawesome.io/license
fontawesome.iohttp	//fontawesome.io/license/http://fontawesome.io/license/%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD	http://fontawesome.iohttp://fontawesome.io/license/http://fontawesome.io/license/��
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
fortawesome.com	-	https://fortawesome.com
a11yproject.com	/posts/how-to-hide-content/	http://a11yproject.com/posts/how-to-hide-content/
www.w3.org	/TR/2013/NOTE-WCAG20-TECHS-20130905/G1	http://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1

Showing 1 to 10 of 80 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

3.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

es bueno pero ahora me va lento el wifi

Jose Garcia·18 Jun 2021

Не подключается. Вообще ни к одной стране. Отзывы липовые.

ЕЦ

Екатерина Цыганкова·16 Jun 2021

Не подключается. Вообще ��и к одной стране. Отзывы липовые.

ЕЦ

Е��атерина Цыган��ова·16 Jun 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Nucleus VPN

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews