Top Risks

• proxy permission routes ALL browser traffic through stealthpath.space, an unverified unknown domain.
• install_url_hijack opens stealthpath.space on install — classic install-time redirect to unknown third party.
• Developer is anonymous gmail user with no name, no verified identity, no business domain.
• Privacy policy is Google's own policy — completely unscoped to this extension; admits data collection and third-party sharing.
• 7 installs with a HIGH-impact proxy permission is a tail-attack-surface red flag (supply-chain risk).

Evidence

• proxy_permission manifest proxy declared — can redirect all Chrome traffic through stealthpath.space, an unknown backend.
• install_url_hijack manifest onInstalled opens https://stealthpath.space/ — same domain as the VPN backend; unsanctioned redirect.
• anonymous_developer store developer_name empty, email milumepid39@gmail.com — free webmail, no business identity, no verified publisher.
• generic_privacy_policy store Privacy policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• small_install_high_perm api Only 7 installs with proxy permission — install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity api JS hosts span CA, RU, US — 3 countries including Russia, notable for a VPN extension.
• no_csp manifest content_security_policy is null — no CSP declared on MV3 extension.
• cve_findings crx No CVE findings detected in bundled JS libraries.

Permissions Breakdown

• proxy high Allows full rerouting of all browser traffic through attacker-controlled infrastructure.
• https://stealthpath.space/* high Unknown domain acting as VPN backend; install_url_hijack targets same domain.
• https://cloudflare-dns.com/* low Legitimate DNS-over-HTTPS provider; expected for VPN DNS resolution.
• https://dns.google/* low Legitimate DNS-over-HTTPS provider; expected for VPN DNS resolution.

Pillar Scores

Bookkeeping