Extension Auditor
Sign Up
Chrome Web Store
13Versions
1Code reviewed

Caution required

Suspicious in code review (v1.9)

Our reviewer found behaviour consistent with malware in version 1.9, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.

26 indicators in this extension

26 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

РуТрекер VPN - расширение для доступа к сайту, used by 200,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by network interception. Its permissions mean it can read and change data on all websites and can observe network requests.

Key findings

  • High

    Network Interception

    When proxy.full is set and its value contains the string 'FindProxyForURL', the extension uses it verbatim as a complete PAC script instead of wrapping it in the default rutracker-only template. The proxy.full value originates from the remotely fetched Telegram configuration, meaning the publisher can silently update all 200,000 users' browsers to route any or all traffic through arbitrary proxy servers without a Chrome Web Store extension update.

  • Medium

    Other

    Proxy server lists and the payment API base URL are fetched from a public Telegram channel ([domain withheld] or [domain withheld]) and lightly encoded with ROT-3, a trivially reversible Caesar cipher that provides no real security but obscures the config from casual inspection. The decoded JSON can update both the proxy server list (field 's') and the payment API endpoint (field 'u'), giving the publisher a covert remote-update channel that bypasses Chrome Web Store review and cannot be detected by static analysis alone.

Analyst notes

The extension's core proxy functionality is consistent with its stated purpose of accessing [domain withheld], and the ML score (0.00) plus a clean permhash cluster ( malware) corroborate benign behavior. However, the extension fetches server configuration remotely from a public Telegram channel ([domain withheld]), decodes it with a trivial ROT-3 Caesar cipher, and the resulting data can include a fully custom PAC script. When a fetched PAC script contains 'FindProxyForURL', it bypasses the rutracker-only default and routes all browser traffic through remotely specified proxies — creating a stealthy remote-control mechanism for traffic routing that operates outside the Chrome Web Store update process. The publisher has other extensions flagged as malicious (10%), and the payment API backend ([domain withheld]) is undisclosed third-party, but no evidence of user-data exfiltration was found in the code.

РуТрекер VPN - расширение для доступа к сайту

РуТрекер VPN - расширение для доступа к сайту Chrome extension security report

ID: llngkcnndicadfcbikbjnhbcikpmaknj

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status
Active
Version
2.4
Size
1.52 MB
Rating
3.4/5
Reviews
196
Users
200,000
Type
Extension
Updated
Jul 4, 2026
Category
Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue
This publisherTrack record
22extensions
2 no longer listed

Publisher Contextual Analysis

Author
sherechevskiy
Privacy
Privacy Policy
Help
Help Center
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
22
Active
20
Obsolete
2
Listed
22
Unlisted
0
Users
282,857

Screenshots & videos

Screenshot 1

Install growth

Item
Type
Severity
Description
proxy
Permission
Critical
This permission allows the extension to control the browser's proxy settings. Rated Critical because it can route all traffic through potentially malicious proxies, enabling man-in-the-middle attacks and traffic monitoring.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestAuthProvider
Permission
Critical
This permission allows the extension to handle authentication requests and modify authentication headers. Rated Critical because it can intercept login credentials, session tokens, and modify authentication flows to compromise accounts.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
browsingData
Permission
High
This permission clears browsing data, history, and redis. Rated High because it can destroy evidence of malicious activity, clear security logs, and modify browser state.
offscreen
Permission
High
This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

26 indicators in this extension

26 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

РуТрекер VPN - это удобный инструмент, который позволяет получить быстрый и безопасный доступ к популярному сайту RuTracker

Read the publisher’s full description

Доступ к RuTracker.org без ограничений Расширение "РуТрекер VPN" — это удобный инструмент, который позволяет получить быстрый и безопасный доступ к популярному торрент-трекеру RuTracker (Rutracker.org) даже в условиях блокировок. С помощью этого расширения вы сможете обойти региональные ограничения и наслаждаться всеми возможностями сайта без лишних сложностей. 💢 Основные функции: ✅ Обход блокировок: Легко получайте доступ к RuTracker и другим заблокированным сайтам в вашем регионе. ✅ Безопасность: Ваше соединение защищено с помощью VPN-технологии, что обеспечивает анонимность и конфиденциальность в сети. ✅ Простота использования: Достаточно установить расширение, активировать его и начать пользоваться RuTracker без ограничений. ✅ Высокая скорость: Оптимизированное соединение позволяет скачивать файлы быстро и без задержек. ✅ Бесплатный доступ: Расширение предоставляет бесплатный доступ к базовым функциям VPN. 💢 Как это работает: ✅ Установите расширение "РуТрекер VPN" в ваш браузер. ✅ Активируйте VPN-соединение одним кликом. ✅ Перейдите на сайт RuTracker и наслаждайтесь беспрепятственным доступом к контенту. 💢 Для кого это: ✅ Для пользователей, которые хотят получить доступ к RuTracker в регионах, где сайт заблокирован. ✅ Для тех, кто ценит анонимность и безопасность в интернете. ✅ Для любителей торрент-трекера, которые хотят скачивать файлы без ограничений. "РуТрекер VPN" — ваш надежный помощник для доступа к любимому ресурсу! Установите расширение и забудьте о блокировках! ‼️Расширение для браузеров Chrome, Яндекс-Браузер, Opera и других на основе Chronium, которое разблокирует доступ к сайту RuTracker.org ‼️Если у вас сайт не заблокирован, то включать расширение не надо. ‼️Если заблокирован, но при этом вы не используете другие плагины для обхода блокировок, то выключите другие расширения ВПН и включите после этого это расширение. ⭐ Наш канал - https://t.me/exstension

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
URLs
13
IPv4
13

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

26 indicators in this extension

26 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
1.9
Latest
1.51 MBCaution0
0db9970f60a7853ce0b95f80d4e5e60886a9a9227469818a62e6c2bacb38cdd7
2.1
1.51 MBNot scanned—
ebd7e00f3e25af9f64ad78e545f5c8ac8911ef21c5c99ff7410ea76b3af1e8b2
2.4
1.52 MBNot scanned—
ebd7e00f3e25af9f64ad78e545f5c8ac8911ef21c5c99ff7410ea76b3af1e8b2
2.3
1.51 MBNot scanned—
ebd7e00f3e25af9f64ad78e545f5c8ac8911ef21c5c99ff7410ea76b3af1e8b2
2.2
1.51 MBNot scanned—
ebd7e00f3e25af9f64ad78e545f5c8ac8911ef21c5c99ff7410ea76b3af1e8b2
2.0
1.51 MBNot scanned—
ebd7e00f3e25af9f64ad78e545f5c8ac8911ef21c5c99ff7410ea76b3af1e8b2
1.8
1.51 MBNot scanned—
0db9970f60a7853ce0b95f80d4e5e60886a9a9227469818a62e6c2bacb38cdd7
1.7
1.51 MBNot scanned—
0db9970f60a7853ce0b95f80d4e5e60886a9a9227469818a62e6c2bacb38cdd7
1.6
1.36 MBNot scanned—
0db9970f60a7853ce0b95f80d4e5e60886a9a9227469818a62e6c2bacb38cdd7
1.5
1.36 MBNot scanned—
0db9970f60a7853ce0b95f80d4e5e60886a9a9227469818a62e6c2bacb38cdd7
Showing 1 to 10 of 20 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In

Related extensions

Popular in Tools