Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — VPN-невидимка [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through stealthpath.space, an unverified unknown domain.
• install_url_hijack opens stealthpath.space on install — classic install-time redirect to unknown third party.
• Developer is anonymous gmail user with no name, no verified identity, no business domain.
• Privacy policy is Google's own policy — completely unscoped to this extension; admits data collection and third-party sharing.

Evidence

• proxy_permission manifest proxy declared — can redirect all Chrome traffic through stealthpath.space, an unknown backend.
• install_url_hijack manifest onInstalled opens https://stealthpath.space/ — same domain as the VPN backend; unsanctioned redirect.
• anonymous_developer store developer_name empty, email milumepid39@gmail.com — free webmail, no business identity, no verified publisher.
• generic_privacy_policy store Privacy policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• small_install_high_perm api Only 7 installs with proxy permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span CA, RU, US — 3 countries including Russia, notable for a VPN extension.
• no_csp manifest content_security_policy is null — no CSP declared on MV3 extension.
• cve_findings crx No CVE findings detected in bundled JS libraries.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — VPN-невидимка [browser-hijack] + malext.io malicious_extension_sentry; score 4.41 -> 6.91 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full rerouting of all browser traffic through attacker-controlled infrastructure.
• https://stealthpath.space/* high Unknown domain acting as VPN backend; install_url_hijack targets same domain.
• https://cloudflare-dns.com/* low Legitimate DNS-over-HTTPS provider; expected for VPN DNS resolution.
• https://dns.google/* low Legitimate DNS-over-HTTPS provider; expected for VPN DNS resolution.

Pillar Scores

Bookkeeping