Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — nevidimyy-vpn [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through echosecure.space, a single unverified Russian-hosted server.
• install_url_hijack redirects to echosecure.space on install — unknown third-party operator.
• Privacy policy is Google's own policy (myaccount.google.com), not scoped to this extension at all — admitted data collection/3rd-party sharing without extension scope.
• Developer is anonymous gmail user with no verified publisher status, no business identity, and no developer name.

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; no host_permissions narrowing scope.
• install_url_hijack crx install_url_hijack=true targeting https://echosecure.space/ — opens unknown 3rd-party on install.
• js_external_hosts crx echosecure.space is the only external JS host; geo=RU; no CDN or known-safe provider.
• privacy_policy_generic store Policy URL is Google account privacy policy — fetched, scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free webmail (gmail), no verified publisher, no business website.
• no_csp manifest content_security_policy=null; csp_present=false for MV3 extension.
• reputation_free_webmail_no_name store vale99505@gmail.com — free webmail + no developer name triggers floor reputation score.
• cve_findings_empty crx No CVE findings detected; js_libraries_detected empty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — nevidimyy-vpn [browser-hijack] + malext.io malicious_extension_sentry; score 3.96 -> 6.46 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Redirects all browser traffic through attacker-controlled server; highest-capability network permission.

Pillar Scores

Bookkeeping