Is VPN для ютуба — YouTubePRO safe?
VPN для ютуба — YouTubePRO is medium risk. Code analysis shows server entries fetched from s-extension.github.io can contain a full PAC script, which the extension installs unchanged as the browser proxy setting.
Who publishes itsherechevskiy - 17 other listings from the same operator, 10 of them carrying a finding
sherechevskiy - 17 other listings from the same operator, 10 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
17 other listings published from this account, 295k+ users between them. 10 of them carry a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension can install a remotely supplied PAC script as the browser proxy
Code analysis shows server entries fetched from s-extension.github.io can contain a full PAC script, which the extension installs unchanged as the browser proxy setting.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open the popup and connect to a server.
The popup first fetches the remote server list.
The extension can install a PAC script taken from that remote list as the browser proxy configuration.
Remote fetch sources and decoding
The script tries each URL in order and uses the first that answers
js/bg.jsasync function getcdata(){ const urls=[urid.gh,urid.bs,urid.gd]; for(const url of urls){ try{ return await fetchDataWithTimeout(url) }catch(error){ console.warn(`Error fetch:`,error.message) } } throw new Error("No data")}Response is decoded and entries stored
popup/main.jsvar c=showx(data.trim(),3);var j=JSON.parse(c);...if(typeof(j['s'])!='undefined'){ chrome.storage.local.set({"servers":JSON.stringify(j['s'])}); ... let k=atob(e).split("|");A remote entry containing FindProxyForURL becomes the PAC script
// setProxy(proxy) in js/bg.js// 1. Use the remote entry (proxy.full) as the PAC text, else the bundled PAC.// 2. If the text already defines FindProxyForURL, it is kept as is.// 3. The result is installed as the browser-wide PAC proxy setting.- s-extension.github.io
Primary source of the server list and PAC entries (DataExst/data.json).
- dtxtension.blogspot.com
First fallback for the same encoded data.
- docs.google.com
Second fallback, a shared Google Doc holding the same data.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.