Top Risks

• proxy permission routes all browser traffic through operator infrastructure
• Privacy policy not scoped to extension and omits data-collection disclosures
• Developer domain aurora-vpn.ru does not resolve despite verified-publisher badge
• Uninstall URL hijack flag set (target unknown)
• 9 content-script domains across similarly-named .ru/pro/space hosts suggest churn

Evidence

• proxy-permission manifest proxy permission declared; host access narrow but traffic routing capability is inherent
• verified-publisher store Web Store verified publisher badge present; reputation discount applied
• dev-domain-unresolvable api threat_intel: aurora-vpn.ru resolves=false; verified discount capped at -1.0 per v3.5(0c)
• privacy-policy-generic crx Policy fetched but scope_extension=false, data_collection=false -> +9; +1 third-party silence
• uninstall-hijack crx uninstall_url_hijack=true, target null; +3.0 webstore per traffic-monetization cluster
• no-cve-code-findings crx cve_findings_raw empty; code_findings_raw empty; obfuscation 0.0
• recently-updated store months_since_update=2 -> maintenance 0
• content-script-domain-sprawl manifest 9 aurora-variant domains (.ru/.pro/.space) as content-script matches

Permissions Breakdown

• proxy high Can route all browser traffic through developer-controlled servers
• storage low Local extension state only
• alarms low Scheduling only

Pillar Scores

Bookkeeping