Is Urban VPN Proxy safe?

#!/usr/bin/env node
// urban-vpn-decode-config.js
// Fetches and decodes Urban VPN's remote ecommerce scraping config.
//
// Requires: Node.js 18+, npm i lz-string
// Usage:    node urban-vpn-decode-config.js > urban-vpn-config.json

const LZString = require("lz-string");

const CONFIG_URL =
  "https://anti-phishing-protection.urban-vpn.com/rest/v2" +
  "/ecommerce/template/config" +
  "?libVersion=10.0.0&partnerId=5";

// Hardcoded Basic-Auth credentials extracted from Urban VPN extension bundle
// (service-worker/index.js, stream._$syncUp._$token)
// Plaintext: George_Michae!:I'll_never_goNNa_dance_again
const AUTH_TOKEN = "R2VvcmdlX01pY2hhZSE6SSdsbF9uZXZlcl9nb05OYV9kYW5jZV9hZ2Zpbg==";

async function main() {
  process.stderr.write(`Fetching config from ${CONFIG_URL}\n`);

  const response = await fetch(CONFIG_URL, {
    headers: {
      Accept: "application/octet-stream",
      Authorization: `Basic ${AUTH_TOKEN}`,
    },
  });

  if (!response.ok) {
    process.stderr.write(
      `HTTP ${response.status} ${response.statusText}\n`
    );
    process.exit(1);
  }

  const contentType = response.headers.get("Content-Type") || "";
  process.stderr.write(`Content-Type: ${contentType}\n`);
  process.stderr.write(
    `Content-Length: ${response.headers.get("Content-Length") || "(chunked)"} bytes\n`
  );

  let parsed;
  if (contentType.includes("application/octet-stream")) {
    // LZ-String UTF-16 compressed path
    const raw = await response.text();
    process.stderr.write(`Compressed size : ${raw.length * 2} bytes (UTF-16)\n`);
    const json = LZString.decompressFromUTF16(raw);
    if (!json) {
      process.stderr.write("ERROR: decompressFromUTF16 returned null — format may have changed\n");
      process.exit(1);
    }
    process.stderr.write(`Decompressed size: ${json.length} bytes\n`);
    parsed = JSON.parse(json);
  } else {
    // Plain JSON fallback
    parsed = await response.json();
  }

  process.stdout.write(JSON.stringify(parsed, null, 2) + "\n");

  // Print summary to stderr
  const marketplaces = Array.isArray(parsed) ? parsed : (parsed.marketplaces || []);
  process.stderr.write(`\nSummary:\n`);
  process.stderr.write(`  Marketplaces/stores in config : ${marketplaces.length}\n`);
  if (marketplaces.length > 0) {
    process.stderr.write(`  First 10 store IDs:\n`);
    marketplaces.slice(0, 10).forEach((m) => {
      const id = m.id || m.marketplaceId || m.name || JSON.stringify(m).slice(0, 60);
      process.stderr.write(`    - ${id}\n`);
    });
  }
}

main().catch((err) => {
  process.stderr.write(`Fatal: ${err.message}\n${err.stack}\n`);
  process.exit(1);
});

// urban-vpn-nav-decoder.js
// Decodes a captured Urban VPN checkSafety POST body.
// The body is LZ-String UTF-16 compressed; this script reverses that.
//
// Usage:
//   1. In Chrome DevTools, open the Network tab.
//   2. Navigate to any page with Urban VPN installed.
//   3. Find the POST to anti-phishing-protection-toolbar.*.com/api/rest/v2/secure/urls/checkSafety
//   4. In the Payload tab, right-click -> Save as -> save the raw body to body.txt
//   5. node urban-vpn-nav-decoder.js < body.txt
//
// Alternative: paste the captured body string into capturedBody below and run without stdin.

const { decompressFromUTF16 } = require('lz-string');
const fs = require('fs');

let capturedBody;
if (!process.stdin.isTTY) {
  capturedBody = fs.readFileSync('/dev/stdin', 'utf16le').replace(/^\uFEFF/, '');
} else {
  // Paste a captured body string here to decode it directly:
  capturedBody = null;
}

if (!capturedBody) {
  console.error('No input. Pipe a captured body via stdin or paste it into capturedBody.');
  process.exit(1);
}

try {
  const decoded = decompressFromUTF16(capturedBody);
  if (!decoded) {
    throw new Error('decompressFromUTF16 returned null -- body may not be LZ-String UTF-16 compressed.');
  }
  const parsed = JSON.parse(decoded);
  console.log('Decoded Urban VPN navigation payload:');
  console.log(JSON.stringify(parsed, null, 2));
} catch (e) {
  console.error('Decode failed:', e.message);
  process.exit(1);
}