Is Buster: Captcha Solver for Humans safe?
Buster is low risk. Buster occasionally opens its 'contribute' page, at most once after 10+ uses/two weeks, or manually. It fetches funding status from sponsors.vapps.dev with the slug/action flag. Options page links capmonster.cloud with an affiliate tag.
Who publishes itArmin Sebastian - 2 other listings from the same operator, none carrying a finding
Armin Sebastian - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 470k+ users between them, none of them carrying a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Contribute page fetch moved to a new sponsors.vapps.dev domain
Buster occasionally opens its 'contribute' page, at most once after 10+ uses/two weeks, or manually.
It fetches funding status from sponsors.vapps.dev with the slug/action flag.
Options page links capmonster.cloud with an affiliate tag.
- Severity
- Low unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open Buster's contribute page, either it opens itself once automatically, or you open it from the extension's Options.
Auto-open only fires after 10+ uses of the extension, 14+ days since install, and at most once every 365 days.
The page fetches your current funding/sponsorship status from a new domain, sponsors.vapps.dev, and renders it as progress bars and a sponsor list.
We captured the request live: GET https://sponsors.vapps.dev/api/v1/status/buster?action=auto returned HTTP 200 with a 142-byte JSON body. No request went to the extension's old contribute.vapps.dev domain.
setup() method; deobfuscation is a variable-rename only, nothing beyond normal minification.
Same logic with the minifier's single-letter locals renamed
data: function() { return { goals: null, sponsors: null, apiHost: "sponsors.vapps.dev", // was "contribute.vapps.dev" in v3.1.0 goHost: "go.vapps.dev" }},methods: { setup: async function() { const action = new URL(window.location.href).searchParams.get("action"), response = await fetch(`https://${this.apiHost}/api/v1/status/${this.extSlug}?action=${action}`), data = await response.json(), exchangeRate = data.funding.currency.exchangeRate; data.funding.value = Math.trunc(data.funding.value / exchangeRate); data.funding.goal = Math.trunc(data.funding.goal / exchangeRate); this.goals = { items: data.goals, funding: data.funding }; if (data.sponsors.length) this.sponsors = data.sponsors; }}HTTP 200, 142-byte JSON body containing funding.value, funding.goal, funding.currency, goals[], and sponsors[], no request to the prior contribute.vapps.dev domain appeared anywhere in the captured session.
- sponsors.vapps.dev
Returns Buster's funding/goal totals and sponsor list. Same developer (vapps.dev) as the prior contribute.vapps.dev endpoint; a backend rename, not a new third party.
- go.vapps.dev
Payment/donation redirect target when you click a funding option on the contribute page (e.g. Patreon, PayPal).
- capmonster.cloud
Third-party CAPTCHA-solving service, listed as a sponsor link on Options with an affiliate tag (utm_source=extbuster). Only reached if clicked; no automatic request is made.