Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by socket.dev
Troywell VPN Lite - unlimited VPN proxy
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 3 weeks ago
- Version
- v4.0.6
- Artifact
- SHA256 30B…01E
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
Requested Permissions
17 permissionsManage other installed extensions
Control the browser's proxy settings
Access and modify data on every website you visit
Intercept, modify, and block all network requests
Read and modify cookies on all sites
AI Security Report
AI Security Review
Evidence context: threat category proxyware; evidence quality moderate.
Troywell VPN Lite - unlimited VPN proxy is advertised as a free service that grants unrestricted access to blocked sites. The store listing contains only a brief description and a developer email of [email protected], with no additional publisher information. The evidence identified ten high‑severity malware‑signature matches, each titled YARA--postinstall_* and each referencing unknown_file. These rules detect generic postinstall_* constructs such as network communication, system commands, crypto operations, and obfuscation. Such patterns are routinely triggered by any Node.js‑based extension that installs dependencies, runs build scripts, or accesses environment variables, and therefore reflect the extension’s construction process rather than malicious functionality. The manifest.json file contains a single medium‑severity finding, MANIFEST-SENSITIVE-PERM-TABS, indicating that the ‘tabs’ permission is declared. This permission is commonly used in VPN‑related extensions to manage UI elements or monitor tab activity and is not inherently risky. No network‑related findings point to unknown domains, tracking URLs, or suspicious external hosts; the findings_summary reports zero IOC entries and no high‑severity network signals that would be expected from proxyware or data‑exfiltration. The extension’s name does not mimic any known legitimate VPN or security product, eliminating typosquatting concerns, and the developer’s personal Gmail address is typical for small‑scale publishers but does not constitute a verified brand. The large number of code‑smell findings (64) stems from bundled npm packages and is expected in extensions that ship with numerous dependencies. A skeptic might claim that the volume of high‑severity malware‑signature matches proves malicious intent; however, each signature targets generic postinstall_* behavior that appears in many legitimate extensions and does not correspond to known malware families or actual payloads. No obfuscation techniques such as zero‑width Unicode characters are present, and no external relay or exit‑node functionality is detected. In conclusion, the only suspicious signals are generic build‑script artifacts, and the extension otherwise behaves as advertised, providing a free VPN without evidence of malicious traffic routing or data collection.
Verdict: likely_false_positive
Key Reasons
- high volume of postinstall YARA matches are typical of build scripts
- no malicious network IoCs or suspicious domains present
- extension name does not impersonate a known legitimate VPN extension
- manifest only requests benign 'tabs' permission
- developer is not a verified publisher but shows no other malicious indicators
False Positive Considerations
- generic postinstall YARA rules
- bundled dependency code-smell matches
- lack of suspicious network IoCs
- personal developer email
Reviewed 2026-05-23; recommended action: no action; model confidence 86%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Troywell VPN Pro - High-speed and safe VPN
[email protected]
种草星球-TikTok爆单神器,商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]