Is NetVerify Suite safe?

Medium risk

NetVerify Suite downloads declarativeNetRequest rules from its own server and applies them without validation.

The extension fetches a rule set from api.netverifysuitenow.top at install, 15 minutes later, every 8 hours and on startup, and replaces all of its browser request rules with it. Because it has access to Google and the vendor's domain, the server can change what those rules do. It also sends install-attribution values and a persistent random ID to the vendor, and sends the hostnames of search results to mywot.com to show safety ratings.

NetVerify Suitev6.2.1Chrome Web Store
49Risk
Who publishes it

NetVerify Suite - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
NetVerify Suite
Website
netverifysuite.me/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension swaps its network rules for a server-supplied ruleset every 8 hours

Code analysis shows the service worker downloads a rule list from api.netverifysuitenow.top and installs it unvalidated as browser request rules for Google and the vendor domain.

The rules themselves were not observed.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You install the extension and later keep your browser open or restart it.

The extension did this

The extension fetches a rule list from the vendor server and applies it to your browser.

It does this 15 minutes after install, every 8 hours, and at browser startup.

When this fires

Every 8 hours

A 15 minute one-shot alarm after install, a repeating 8 hour alarm, and a call on each browser startup all trigger the rule download.

The code that does this

Rule download and install path

Readable version

Alarms and startup hook that trigger the ruleset pull

service-worker-loader.js
function scheduleAlarm() {  const periodInMinutes = 8 * 60;  chrome.alarms.create("ping", { periodInMinutes });  chrome.alarms.create("postInstall", { delayInMinutes: 15 });}chrome.alarms.onAlarm.addListener((alarm) => {  if (alarm.name === "ping" || alarm.name === "postInstall") {    ur("KeepAlive");  }});chrome.runtime.onStartup.addListener(() => {  ur("KeepAlive-Startup");  setupUninstallURL();});function getHeaders() {  const encodedKey = "V2hzeTMtZGtpSUc2LXNranc3Zy03aEcyOA==";

Request to the vendor backend and parse of the returned JSON

service-worker-loader.js
    var Geturl = apiurl + "/getRuleset/" + euid;    const response = await fetch(Geturl, requestOptions);    if (!response.ok) {      const errorText = await response.text();      throw new Error(        `Request failed with status ${response.status}: ${errorText}`      );    }    const rules = await response.json();    return rules;  } catch (error) {    throw error;  }}

Returned JSON is installed as the dynamic rule set

service-worker-loader.js
async function ur(reason) {  try {    const newRules = await fr(reason);    chrome.declarativeNetRequest.getDynamicRules((previousRules) => {      const previousRuleIds = previousRules.map((rule) => rule.id);      chrome.declarativeNetRequest.updateDynamicRules({        removeRuleIds: previousRuleIds,        addRules: newRules,      });    });  } catch (error) {    console.error(error);  }}

Hardcoded API key sent with the request

service-worker-loader.js
function getHeaders() {  const encodedKey = "V2hzeTMtZGtpSUc2LXNranc3Zy03aEcyOA==";  const apiKey = atob(encodedKey);  const headers = new Headers();  headers.append("x-api-key", apiKey);  headers.append("Content-Type", "application/json");  return headers;}
What the request contains and what is applied
  • Request reason
    {"r":"KeepAlive-Startup"}

    Tells the server whether this pull was an alarm or a startup.

  • API key header
    x-api-key: (base64-decoded constant in getHeaders)

    A fixed key shipped in every copy, so it identifies the extension, not you.

  • Install identifier
    https://api.netverifysuitenow.top/api2/getRuleset/<install uid>

    A per-install id in the URL ties each rule pull to your installation.

  • Returned rules
    JSON array passed to addRules

    Whatever the server sends replaces every existing rule; contents were not visible in static review.

Hosts involved
    • api.netverifysuitenow.top

    Vendor backend that creates the install id and serves the ruleset

    • www.google.com

    Host permission lets server rules act on Google pages

    • mywot.com

    Also covered by host permissions

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 6.2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on www.mywot.com

    https://www.mywot.com/api/safetyCheck*

  • Read and change your data on netverifysuitenow.top

    *://*.netverifysuitenow.top/*

  • Read and change your data on www.google.com

    *://www.google.com/

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed NetVerify Suite contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.mywot.com

    NetVerify Suite sends data to www.mywot.com. 3 other extensions we have analysed send data here.

  • api.netverifysuitenow.top

    NetVerify Suite sends data to api.netverifysuitenow.top. No other extension we have analysed sends data here.

Updated 15 October 2026kmilnphpamalmmmadicopjjknmpcfigd