Is Squid VPN - Hotspot VPN & Private Browser safe?

Medium risk

Squid VPN sends your public IP address to a hardcoded authorization server every minute.

When the extension starts and on a repeating one-minute alarm, it asks proxy.webshare.io for the browser's public IP address. It then posts that IP address as JSON to a hardcoded HTTP endpoint at 162.55.163.112:8080, along with an Authorization header.

Paris FrenchTechv3.0.0Chrome Web Store
50Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Squid VPN ships hardcoded tokens used to authorize its IP-reporting requests

Squid VPN embeds two fixed access tokens in its background script and reuses the same values in every install to authorize requests to a proxy provider and an unbranded IP-logging server.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

The background service worker runs its IP-authorization routine at startup and on every one-minute alarm.

This is the same routine covered by the plaintext-IP-report finding on this extension.

The extension did this

It attaches two access values that are hardcoded in the shipped code to authenticate the two outbound requests.

Both values are identical across every install; neither is generated per-user or per-session.

Hardcoded values found in background.js
  • Webshare API token
    Token c18d87i3ppawabtt52m3zx0c3r851xvp9a34cs9l

    A fixed token used to call Webshare's IP-authorization API; ships identically in every copy of the extension.

  • Second Authorization value
    b829b507309fed3ed2dab60f

    A fixed value used to authenticate the cleartext IP report; identical for every install.

  • Where it's found
    background.js, lines 130-155

    Both values sit as plain string literals in the unminified background script.

The code that does this

Hardcoded Authorization literals in background.js

Readable version

Same code; the file already ships unminified

background.js:130-155
function Get_User_IP() {    return fetch("https://proxy.webshare.io/api/v2/proxy/ipauthorization/whatsmyip/", {        headers: {            Authorization: "Token c18d87i3ppawabtt52m3zx0c3r851xvp9a34cs9l"        }    }).then(response => response.json()).then(resp => create_IP_auth(resp.ip_address));}function create_IP_auth(my_ip) {    fetch("http://162.55.163.112:8080/api/v1/ipauthorization", {        method: "POST",        body: JSON.stringify({            ip_address: my_ip        }),        headers: {            "Authorization": "b829b507309fed3ed2dab60f",            'Content-Type': 'application/json'        }    })        .then(response => response.json())        .then(data => console.log(data))}
Check if you're affected

Reads background.js and extracts both hardcoded Authorization literals used by the IP-authorization workflow.

Requires
  • Node.js 18+
extract-ipauth-tokens.js · js
const fs = require('fs');const path = process.argv[2];if (!path) {  console.error('usage: node extract-ipauth-tokens.js <path-to-background.js>');  process.exit(1);}const src = fs.readFileSync(path, 'utf8');const webshareMatch = src.match(/Authorization:\s*"([^"]+)"/);const secondMatch = src.match(/"Authorization":\s*"([^"]+)"/);if (!webshareMatch || !secondMatch) {  console.error('No hardcoded Authorization literals found in this file.');  process.exit(1);}console.log('Webshare Authorization header:', webshareMatch[1]);console.log('Second Authorization header:', secondMatch[1]);
How to run it
  1. 1Unzip the extension's CRX.
  2. 2Run node extract-ipauth-tokens.js path/to/background.js.
  3. 3The script prints both recovered Authorization header values.

What it can do

Permissions this extension asks for, as declared in version 3.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/* and 1 more

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Route all of your browsing through a server of its choosing

    proxy

  • Schedule its own background tasks

    alarms

  • See, disable and uninstall your other extensions, including your security ones

    management

Where it sends data

Destinations our analysis observed VPN contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 162.55.163.112:8080

    VPN sends data to 162.55.163.112:8080. No other extension we have analysed sends data here.

  • proxy.webshare.io

    VPN sends data to proxy.webshare.io. No other extension we have analysed sends data here.

Updated 21 September 2026ofbgjmmbmmdehioamfhccohdgiajbajj