Top Risks

• proxy permission allows full traffic interception/redirection to any server, extremely dangerous from unknown developer
• Privacy policy URL returns HTTP error (fetch_error); policy effectively absent for a VPN extension that routes all traffic
• Developer is free-webmail (gmail), no developer name, no verified publisher — zero accountability for a traffic-intercepting tool
• JS hosted on tarakanvpn.online (RU-hosted), a non-resolving or error-returning domain with no developer identity verification
• Only 46 installs with high-tier proxy permission — tail-attack-surface anomaly flagged

Evidence

• proxy_permission manifest proxy declared; extension can silently reroute all browser traffic through attacker-controlled servers.
• privacy_policy_fetch_error api Privacy policy URL https://tarakanvpn.online/privacy/ returned HTTPError; policy treated as absent (+10.0 Privacy).
• free_webmail_dev_no_name store Developer email kameqoko032@gmail.com (Gmail); no developer name listed; no verified publisher badge.
• js_external_host_ru crx JS communicates with tarakanvpn.online (RU), single-country geo diversity; domain not verified.
• small_install_high_perm api install_perm_anomaly: 46 installs with HIGH-tier proxy permission — tail attack surface flagged.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP hardening for background.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no accountability signals for traffic-intercepting VPN.
• cve_findings_empty crx No bundled JS libraries detected; CVE pillar = 0.0.

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy servers; critical capability for a VPN but highest-risk permission.

Pillar Scores

Bookkeeping