Is Free VPN For Chrome & Ad blocker - Planet VPN safe?

#!/usr/bin/env node
/**
 * Reproducer for claim 14289 — Planet VPN (hipncndjamdcmphkgngojegjblibadbe v2.5.0)
 * CWE-506: Backend API URL resolved via Telegraph dead-drop with hardcoded AES-CBC key
 *
 * Source: background.js (deobfuscated) lines 8777-8846
 *
 * The extension assembles an AES-256-CBC key from three hardcoded string literals,
 * strips the '+' characters to produce a Base64 key, then uses it to decrypt
 * content fetched from a Telegraph page (dead-drop resolver).
 *
 * Usage:
 *   node planet-vpn-telegraph-decrypt.js
 *
 * Expected output: JSON with domain_api, domain_gapi, domain_cdn fields showing
 * the operator-controlled backend API domain.
 */

const https = require('https');
const crypto = require('crypto');

// Step 1: Reconstruct AES key from deobfuscated/background.js:8778-8786
// of() function: strips '+' from each part, concatenates
const t = 'C3g4V+nKy7r+iXc/p'; // background.js:8778
const e = 'G5Gab+bMpwa+Dh940'; // background.js:8779
const s = 'P82d+ulCj+zx72A=';  // background.js:8780
const stripPlus = u => (u ? u.split('+').join('') : '');
const aesKeyB64 = stripPlus(t) + stripPlus(e) + stripPlus(s);
// aesKeyB64 = 'C3g4VnKy7riXc/pG5GabbMpwaDh940P82dulCjzx72A='

console.log('=== Hardcoded AES-256-CBC Key (Base64) ===');
console.log(aesKeyB64);
const aesKey = Buffer.from(aesKeyB64, 'base64');
console.log('Key length:', aesKey.length, 'bytes (AES-256)');
console.log('Key hex:', aesKey.toString('hex'));
console.log('');

// Step 2: Fetch Telegraph dead-drop page (background.js:1687)
const telegraphUrl = 'https://api.telegra.ph/getPage/E-04-01-3?return_content=true';
console.log('=== Fetching Telegraph dead-drop ===');
console.log('URL:', telegraphUrl);

https.get(telegraphUrl, res => {
  let data = '';
  res.on('data', chunk => (data += chunk));
  res.on('end', () => {
    const json = JSON.parse(data);
    // Extract content[0].children[0] per background.js:8818
    const encryptedB64 = json.result.content[0].children[0];
    console.log('Encrypted payload (first 80 chars):', encryptedB64.substring(0, 80) + '...');
    console.log('');

    // Step 3: Decrypt per jr() at background.js:8788-8800
    // Inner envelope: Base64-decode -> parse JSON -> {iv, value}
    const envelope = JSON.parse(Buffer.from(encryptedB64, 'base64').toString('utf8'));
    const iv = Buffer.from(envelope.iv, 'base64');
    const ciphertext = Buffer.from(envelope.value, 'base64');
    const decipher = crypto.createDecipheriv('aes-256-cbc', aesKey, iv);
    const decrypted = Buffer.concat([
      decipher.update(ciphertext),
      decipher.final(),
    ]).toString('utf8');

    console.log('=== Decrypted Backend Configuration ===');
    const config = JSON.parse(decrypted);
    console.log(JSON.stringify(config, null, 2));
    console.log('');
    console.log('RESULT: Operator can rotate all API traffic by updating the Telegraph page.');
    console.log('Current active domain_api:', config.domain_api);
  });
}).on('error', err => {
  console.error('Request failed:', err.message);
});