StayFree - Website Blocker, Web Usage Stats, Shorts Blocker

AI Security Review

Evidence context: threat category none; evidence quality moderate.

StayFree is a website blocker and screen-time tracker published by stayfreeapps.com, at version 2.10.9 with 200,000 Chrome users. Eight network findings land in the code you would expect to talk to a server: background.js:15, content-scripts/usage-monitoring.js:15, content-scripts/in-app-blocking.js:1 and content-scripts/gen-ai-collector.js:15 each make a fetch call, while chunks/index-Buu2g0Em.js:11, chunks/DashboardPomodoroSettings-__kuc9W8.js:1 and chunks/recent-apps-provider-Di_YF8bY.js:10 pull in socket.io. A dashboard that shows a timer moving needs exactly that plumbing.

The nine obfuscation hits are all the same rule, OBFUSCATION-UNICODE_HEAVY, and every one sits inside compiled output: chunks/DashboardSettings-DgQQFLBX.js:1, chunks/defineAppConfig-GowsFsJW.js:44, content-scripts/keyword-blocking.js:102, content-scripts/ad-finder.js:11, content-scripts/block-website.js:1, content-scripts/gen-ai-collector.js:128, content-scripts/in-app-blocking.js:74, content-scripts/usage-monitoring.js:122 and background.js:136. The hashed chunk filenames are Vite or webpack artifacts. A one-line bundle holding translated interface strings, emoji and copy in non-Latin scripts scores high on a non-ASCII character count with nothing concealed in it. There is no zero-width character finding and no packed payload anywhere in the set.

Nothing in the malware categories fires. No indicators of compromise were extracted, no malware signature matched, and no finding touches cookies, session tokens or login pages. The name is the brand: stayfreeapps.com matches the publisher field, so there is no typosquat and no lookalike brand to point at.

A skeptic has a fair objection. The scan captured no permission list and no host names, so the fetch calls are visible while their destinations are not, and the summary counters report zero findings against seventeen listed ones, which is a bookkeeping fault on the scanning side rather than extension behavior. An extension reading pages through content-scripts/ad-finder.js and content-scripts/keyword-blocking.js does hold the reach to ship page content anywhere. Two things keep that from being a finding here: no third-party hosts are embedded in the code, and the traffic shapes match the advertised product surface, down to a collector dedicated to AI chat sites. Confirming destinations would take a manifest and a request log, which this scan did not keep.

What the extension does with page access is the product itself: counting time in content-scripts/usage-monitoring.js, matching block rules in keyword-blocking.js, spotting sponsored slots in ad-finder.js. That is broad reach over browsing, and it is the reach the store description advertises. The evidence shows a tracking product doing its stated job with obfuscation flags raised by its build tooling.

Key Reasons

• All nine obfuscation findings are OBFUSCATION-UNICODE_HEAVY inside hashed minified chunks such as chunks/DashboardSettings-DgQQFLBX.js and chunks/defineAppConfig-GowsFsJW.js, a common artifact of bundled translations and UI copy
• Network findings are fetch and socket.io calls in background.js:15 and content-scripts/usage-monitoring.js:15, matching a live usage dashboard
• No IoCs, malware signatures, credential or cookie access, or lookalike domains appear anywhere in the evidence
• Publisher domain stayfreeapps.com matches the product name, so there is no typosquat signal
• Manifest permissions and request host names were not captured, leaving the fetch destinations unverified

False Positive Considerations

• UNICODE_HEAVY rule firing on minified Vite/webpack chunks with bundled i18n strings and emoji
• NET-FETCH and NET-SOCKET_IO matching expected realtime dashboard traffic for a screen-time tracker
• Missing manifest data and summary counters that report zero findings while the category lists hold seventeen

Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 78%.