Top Risks

• proxy permission allows complete interception and rerouting of all browser traffic to echosecure.space (RU-hosted).
• Install URL hijack opens echosecure.space on installation — classic malware/ad-tech onboarding signal.
• Privacy policy is Google's own policy, not scoped to this extension; data collection and 3rd-party sharing admitted without extension-specific disclosure — +10.0 privacy.
• Free-webmail developer (asdro1905@gmail.com), no developer name, no verified publisher — anonymous actor with high-capability permission.
• Only 32 installs with HIGH-tier permission (proxy) flags tail-attack-surface / supply-chain probe pattern.

Evidence

• install_url_hijack crx install_url_target=https://echosecure.space/ opened on install; extension also lists echosecure.space as sole JS external host.
• proxy_permission manifest proxy declared; combined with install hijack to RU-hosted domain this routes all traffic through attacker infrastructure.
• privacy_policy_generic store Policy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true). Scores +10.0.
• anonymous_developer store developer_name empty, free-webmail gmail address, no verified publisher, no featured badge.
• small_install_high_perm api 32 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm=true.
• js_external_host_ru crx echosecure.space hosted in RU; sole external JS host for a VPN/proxy extension with no CSP.
• no_csp manifest content_security_policy is null; MV3 default provides some protection but no explicit CSP declared.
• reputation_signals store Free webmail dev + no dev name + no business website: reputation floor >= 7.5 per rubric.

Permissions Breakdown

• proxy high Full proxy control; can reroute all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping