Is Troywell VPN Lite - unlimited VPN proxy safe?

High risk

Troywell VPN Lite - unlimited VPN proxy is high risk. Each launch, the extension fetches eight config files from troywell.org with no notification. These set which sites bypass the VPN proxy, which merchants trigger coupons, and which competing extensions get disabled, changeable at runtime.

Troywellv4.0.5Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote Config Controls Proxy Routing and Affiliate Targeting

Each launch, the extension fetches eight config files from troywell.org with no notification.

These set which sites bypass the VPN proxy, which merchants trigger coupons, and which competing extensions get disabled, changeable at runtime.

01EvidenceFIELD TABLE
Unknown block kind: field_table

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "field_table",
  "caption": "Remote configuration endpoints confirmed in network traffic",
  "fields": []
}
02EvidenceCODE COMPARE
Unknown block kind: code_compare

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "code_compare",
  "caption": "vpnExcludeList drives PAC script construction, server controls which sites bypass the tunnel",
  "language": "js",
  "shipped": [],
  "deobfuscated": []
}
03EvidenceCODE COMPARE
Unknown block kind: code_compare

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "code_compare",
  "caption": "terminator config fetched at bg/bundle.js:7694-7700, server-supplied list of extensions to disable",
  "language": "js",
  "shipped": [],
  "deobfuscated": []
}
04EvidenceTHIRD PARTY LIST
Config infrastructure
  • troywell.org

    Extension vendor, serves all runtime configuration

Updated 10 September 2026honjoefhlidgdidlcdbipobjnoliiaid