Flagged in the threat library: Troywell VPN

Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →

Also reported by socket.dev

Chrome Web Store

Troywell VPN Lite - unlimited VPN proxy

by [email protected] · 50.0K users · 3.4 rating
739ebdeb-c184-50e9-9dbd-ffef23c9f50d | v4.0.6
65/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
3 weeks ago
Version
v4.0.6
Artifact
SHA256 30B…01E
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

5 detail rows

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

44
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
3
Portfolio

11 evidence rows available.

Finding Categories

4
Obfuscation

Requested Permissions

17 permissions
management

Manage other installed extensions

Dangerous
proxy

Control the browser's proxy settings

Dangerous
<all_urls>

Access and modify data on every website you visit

Dangerous
webRequest

Intercept, modify, and block all network requests

High
cookies

Read and modify cookies on all sites

High
tabs
Medium
webRequestAuthProvider
Low
webNavigation
Low
storage
Low
alarms
Low
unlimitedStorage
Low
notifications
Low
privacy
Low
scripting
Low
declarativeNetRequest
Low
declarativeNetRequestWithHostAccess
Low
declarativeNetRequestFeedback
Low

AI Security Report

AI Security Review

Evidence context: threat category proxyware; evidence quality moderate.

Troywell VPN Lite - unlimited VPN proxy is advertised as a free service that grants unrestricted access to blocked sites. The store listing contains only a brief description and a developer email of [email protected], with no additional publisher information. The evidence identified ten high‑severity malware‑signature matches, each titled YARA--postinstall_* and each referencing unknown_file. These rules detect generic postinstall_* constructs such as network communication, system commands, crypto operations, and obfuscation. Such patterns are routinely triggered by any Node.js‑based extension that installs dependencies, runs build scripts, or accesses environment variables, and therefore reflect the extension’s construction process rather than malicious functionality. The manifest.json file contains a single medium‑severity finding, MANIFEST-SENSITIVE-PERM-TABS, indicating that the ‘tabs’ permission is declared. This permission is commonly used in VPN‑related extensions to manage UI elements or monitor tab activity and is not inherently risky. No network‑related findings point to unknown domains, tracking URLs, or suspicious external hosts; the findings_summary reports zero IOC entries and no high‑severity network signals that would be expected from proxyware or data‑exfiltration. The extension’s name does not mimic any known legitimate VPN or security product, eliminating typosquatting concerns, and the developer’s personal Gmail address is typical for small‑scale publishers but does not constitute a verified brand. The large number of code‑smell findings (64) stems from bundled npm packages and is expected in extensions that ship with numerous dependencies. A skeptic might claim that the volume of high‑severity malware‑signature matches proves malicious intent; however, each signature targets generic postinstall_* behavior that appears in many legitimate extensions and does not correspond to known malware families or actual payloads. No obfuscation techniques such as zero‑width Unicode characters are present, and no external relay or exit‑node functionality is detected. In conclusion, the only suspicious signals are generic build‑script artifacts, and the extension otherwise behaves as advertised, providing a free VPN without evidence of malicious traffic routing or data collection.

Verdict: likely_false_positive

Key Reasons

  • high volume of postinstall YARA matches are typical of build scripts
  • no malicious network IoCs or suspicious domains present
  • extension name does not impersonate a known legitimate VPN extension
  • manifest only requests benign 'tabs' permission
  • developer is not a verified publisher but shows no other malicious indicators

False Positive Considerations

  • generic postinstall YARA rules
  • bundled dependency code-smell matches
  • lack of suspicious network IoCs
  • personal developer email

Reviewed 2026-05-23; recommended action: no action; model confidence 86%.

About This Extension

VPN for Chrome is a service that creates an extra secure connection to the internet while using the corresponding browser. Protection is provided by different methods of traffic encryption, thanks to which the network does not leave personal user data (Last Name, First Name, bank card numbers and the like), hides information about a particular session and unlocks websites that are region-locked. VPN for Chrome can be installed by downloading from this site in a couple of clicks. But the benefits of the program may not be obvious, so you need to figure out why to install it in your browser. *Notice: our product involves the use of a loyalty program (affiliate program). Detailed description is given below. How to use? VPN Chrome extension improves the browser and gives it new features. At the same time, it is an ordinary application with low resource consumption. Usually, such extensions do not require configuration, work in all operating systems and are distributed for free. Most users install VPN for Google Chrome to bypass territorial blocking of web resources, to order goods online or to transmit important information online. But, in fact, free VPN Chrome has a long list of useful features: helps to visit resources anonymously - masks the IP address and no one will know which user was on the site; provides a connection to any site on the Internet - VPN on Chrome will help bypass any blocking; maintains a stable and high-quality connection - the extension has many different servers, which provides a continuous and fast exchange of traffic; provides security of personal information - any connection hides the user's personal data and other people can't see it; masks Internet connection traffic - VPN for Google Chrome changes the user's IP so that it's impossible to locate the computer; allows you to safely use Wi-Fi connection - if you often have to connect to public "Wi-Fi" networks in transport or cafes, the VPN in Chrome can protect the data on your device; extends encryption to any personal information - not only personal data will be safe, but also the history of visited sites and searches; Based on the above functions, downloading and installing a VPN on "Chrome" will be useful for very many people. It is recommended, first of all, to do this to those who often visits blocked sites, buys goods online, sends via the network valuable information or simply do not want to leave their data on the Internet. One of the most popular and high-quality extensions is the Lite version. It's downloadable right from this page. Why is Troywell Lite the optimal solution in the Google Chrome browser? The extension is the optimal version of VPN for Chrome. The extension provides all the features listed earlier. But that's not the best part either. The main pluses of Troywell VPN Lite are: the highest network connection speed among all analogues and the complete absence of restrictions and limits. Many other programs require you to buy a paid version or settle for a severely cut version. Here all the features are included at once, free of charge and not limited to anything. How to get an extension and put in the browser "Google Chrome"? Very simple, in fact. It does not require any special knowledge, a lot of effort or too much time. The whole process is completely done in one click of the mouse right on this site. You need to click on the button "Install" and accept the confirmation of the action. Then everything will happen automatically. The plugin will download and install itself into the browser in a few seconds or a couple of minutes. As soon as the icon of the extension is displayed in the control panel, you can start using the program. How do I activate the features of Troywell VPN Lite after installation? After a quick and easy installation of VPN on Chrome, you need to understand its functionality. It's not difficult at all and you don't need to be an IT expert to do it. Troywell is the best VPN for Chrome not because it is completely free and has a wide range of features. Its creators cared about customers and made the interface simple and clear at a glance. Easy to set up, use and activate is a great advantage of Troywell VPN Lite. You can see the extension icon on the control panel in your browser, you can hide it if you want. To start using the VPN, you need to activate it by clicking on the Troywell icon in your browser. A small window will open with a large activation button. It is difficult to confuse it with any other. Then you need to click on it, and already in a few seconds VPN will turn on. Now you can use all the features of the extension: visit sites with regional blocking, encrypt your traffic and personal data and hide your browsing history from others. Inside the window where the program has been activated, you can see a new IP address. This is associated with the server used by the extension. In addition, in the window you can see the duration of the current session, the amount of traffic (downloaded and sent) in megabytes, statistics on the application's monthly connections and the sites that the user has added to the exceptions. But these are not the most important messages. The most important information is the location of the server through which the connection is going at the moment. The client may not be satisfied with using a server in a particular region. A common situation is that the site is blocked in the country through which it is currently connected. If while surfing the Internet, the user has done everything necessary through the VPN, and now he does not need the Troywell application, it can be disabled. To do this, click on the icon on the control panel and click on "Disable VPN". The extension will turn off immediately, but its icon will remain in the browser. When you need to turn it on again, you can do this according to the instructions given above. "Enabling" and "activating" for this program are the same thing. You shouldn't completely remove the VPN from your browser, as it comes in handy on a regular basis when you're actively using the Internet. Bottom line . Troywell VPN Lite for Chrome is the highest quality and smartest browser app in its segment. With its functions, the user changes the IP address and bypasses site bans, encrypts personal data and keeps them safe, exchanges important documents with other people and does not fear for their safety, and many other things. And all these features are available completely free of charge and in one click. After a few days of use, everyone is convinced that this is the best option among all the WAP extensions. Download and activate the extension on Chrome and you will have absolutely secure access to the entire Internet. Troywell VPN Lite for Chrome browser is a great app for encrypting traffic, bypassing blocking and creating secure connections. Its wide functionality and easy installation will appeal to anyone who uses the Internet a lot and regularly. Why participating in Troywell loyalty program Why participating in Troywell loyalty program At Troywell Diamonds, we believe in rewarding our customers for their loyalty. That's why we've created a Bonus Program and Cashback service to help you save money on your online purchases. Our Bonus Program is easy to join and completely costless — you don't have to pay anything to participate. Plus, our virtual private network service is included at no extra cost, so you can shop and browse safely. To start earning cashback, all you have to do is register with our service. We recommend using our browser extension for the best cashback tracking, and you can easily see your Troywell Diamonds points balance at the top of the menu. We also offer a special promo code activator to help you save even more money when shopping at our partner stores. And don't worry, our service remains free for you to use, thanks to our partnerships with these stores. So, make sure to sign up today and start earning cashback with Troywell Diamonds!

Frequently Asked Questions