Is ВПН для Notion / VPN for Notion safe?

VPN for Notion fetches its proxy server credentials from unauthenticated GitHub, Blogspot, and Google Docs pages with no integrity check.

To pick which proxy server it routes Notion traffic through, the extension's background worker downloads a base64-encoded host:port:login:password list from a GitHub Pages JSON file, a Blogspot post, or a Google Docs document, trying each in turn, and stores whatever it gets with no signature or checksum verification before installing it as the active PAC proxy. The proxy login and password are then kept in plaintext in browser storage, used to auto-answer proxy authentication challenges, and also passed as plaintext URL parameters to a popup window that displays them on screen.

Rated medium risk because of who publishes it: 2 of the 7 other listings from the same operator are rated high or critical for malicious behavior. Flagged: Total VPN - один ВПН для всего (high), ВПН для Телеграм / VPN for Telegram (high).