ВПН для Notion / VPN for Notion

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension's security findings are dominated by false positives from the IoC extractor. The 187 IoC detections include patterns like XIOC-DOMAIN-this.map, XIOC-DOMAIN-e.style, XIOC-DOMAIN-e.target, XIOC-DOMAIN-c.predispatch.call, and XIOC-DOMAIN-s.event.handlers.call — all of which are JavaScript property access chains being misinterpreted as domain names. This matches the documented false positive pattern where the XIOC extractor reads property chains (e.g., e.target, this.map, c.postdispatch.call) as suspicious domains. These are not real network destinations.

Critically, the extension has zero malware signatures, zero obfuscation findings, and no code-smell findings that would indicate malicious intent. The 39 code-smell findings are low-severity noise from generic patterns. The 5 network findings would need inspection to determine if they're legitimate or suspicious, but without specific domain evidence, they cannot drive a verdict.

The extension name "ВПН для Notion / VPN for Notion" and Russian description "Верните себе доступ к Notion" (Restore your access to Notion) suggest it targets users in regions where Notion may be restricted. While the concept of a "VPN for Notion" is technically questionable (VPNs don't work site-specifically), this could be legitimate regional access tooling or misleading marketing rather than confirmed malicious behavior.

The developer uses a generic Gmail address ([email protected]) rather than a corporate domain, which is common for smaller extensions but warrants scrutiny. With 374 users, this is not a widely adopted extension.

Strongest counterargument: A skeptic could argue the "VPN for Notion" naming is a social engineering lure similar to the "Free VPN" pattern, potentially routing traffic through unknown servers. However, without malware signatures, obfuscation, or evidence of traffic routing to suspicious domains, this remains speculation. The actual findings show no malicious code patterns — only false positive IoC noise. If runtime analysis revealed traffic to unknown proxy servers or credential exfiltration, the verdict would change. Until then, the evidence points to false positives.

Key Reasons

• All IoC findings are property access chain false positives (e.g., e.target, this.map, c.predispatch.call)
• Zero malware signatures detected
• Zero obfuscation findings
• No specific suspicious domains identified beyond IoC noise

False Positive Considerations

• XIOC property access chain misinterpretation
• Code-smell low-severity noise
• Generic JavaScript patterns flagged as IoCs

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 75%.