Top Risks

• proxy permission routes ALL browser traffic through developer-controlled SOCKS5 servers — maximum traffic interception capability.
• Privacy policy URL returns HTTP error (unfetchable); effectively no privacy policy for a VPN tool that sees all traffic.
• Free-webmail developer (gmail), no developer name, no verified publisher — unaccountable operator of a proxy extension.
• Only 9 installs with high-impact permission (proxy) — tail-attack-surface anomaly flagged.
• Single JS external host spidervpn.online; domain unverifiable; MV3 with no CSP declared.

Evidence

• proxy_permission manifest proxy declared — extension can silently reroute all browser TCP connections through any server it chooses.
• privacy_policy_fetch_failed api https://spidervpn.online/privacy returns HTTPError; policy unreadable — scored as no policy (+10.0 privacy).
• free_webmail_no_dev_name store silviaferr79@gmail.com, no developer_name; free-webmail + no business presence → reputation floor 7.5.
• small_install_high_perm api install_perm_anomaly.small_install_high_perm=true; 9 installs with proxy permission is a tail-attack-surface signal.
• no_csp manifest content_security_policy is null on MV3 extension; no explicit CSP hardening.
• js_external_host crx js_external_hosts=[spidervpn.online]; single RU-geolocated external endpoint for a VPN/proxy product.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors present.
• code_findings_empty crx code_findings_raw=[] and obfuscation_score=0.0; no malicious code detected but 5 JS files scanned.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled SOCKS5 servers.
• storage low Local key-value store; standard for settings persistence.

Pillar Scores

Bookkeeping