Is 96编辑器小工具 safe?

Medium risk

96编辑器小工具 is medium risk. We observed the extension fetch a proxy script from bj.96weixin.com and apply it to Chrome's regular profile after the server reported a newer version. The script sent only Chrome update hosts to a SOCKS5 server.

96编辑器v1.1.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

96weixin editor tool can apply a vendor-supplied proxy script to Chrome

MediumunwantedCWE-829Dynamic sandbox

We observed the extension fetch a proxy script from bj.96weixin.com and apply it to Chrome's regular profile after the server reported a newer version.

What actually happens

You did this

The 96weixin server reports a version newer than the one installed.

The extension did this

The extension downloads a proxy script and sets it as Chrome's proxy configuration.

The script text is used as received, with no local validation.

Captured request

GEThttps://bj.96weixin.com/extensions/versionInfo

Live response reported version 1.1.2. For the test this response was replaced with {"status":1,"version":"9.9.9"} to simulate a newer release.

Captured request

GEThttps://bj.96weixin.com/extensions/proxy.pac

200 OK. PAC script routing clients2.google.com and clients2.googleusercontent.com to SOCKS5 45.76.181.106:1777 with DIRECT fallback; all other hosts DIRECT.

The code that does this

Function that applies the downloaded proxy script

Readable version

Formatted

dist/background/index.mjs
async function setProxy() {  try {    const e = {      mode: "pac_script",      pacScript: {        data: await (await fetch(ft.url + "extensions/proxy.pac")).text()      }    };    await chrome.proxy.settings.set({ value: e, scope: "regular" });    return new Promise(g => {      mt.getTimeout("http://clients2.google.com/", 3e3)        .then(l => { g(true) })        .catch(async l => { await chrome.proxy.settings.clear({}); g(false) })    })  } catch (t) {    console.error("setProxy.", t);    await chrome.proxy.settings.clear({});    return false  }}

Hosts involved

    • bj.96weixin.com

    Vendor server that reports the latest version and serves the proxy script.

    • 45.76.181.106

    SOCKS5 server (port 1777) named in the observed proxy script for Chrome update hosts.

Updated 2 November 2026kmkagoolneedcbnifoloebjkdomdngdn