Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Какаду VPN – яркий proxy с быстрым подключением [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through developer-controlled sverchvpn.space with no accountability
• Privacy policy is Google's generic policy — does not scope to this extension, admits data collection & 3rd-party sharing
• Free-webmail developer (gmail), no dev name, no verified publisher, throwaway-pattern identity
• Install URL hijack opens sverchvpn.space on install — unsolicited 3rd-party redirect

Evidence

• proxy_permission manifest proxy declared — can silently reroute all Chrome traffic to sverchvpn.space (RU-hosted).
• install_url_hijack crx onInstalled opens https://sverchvpn.space/ — unsolicited 3rd-party page redirect on install.
• js_external_host crx Extension contacts sverchvpn.space; only country seen is RU.
• privacy_policy_generic store Policy URL is Google account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store No developer name, free-webmail email aslikap21@gmail.com, no verified publisher, no featured badge.
• small_install_high_perm api Only 8 installs with proxy (HIGH-tier) permission — install_perm_anomaly flagged.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction set.
• cve_findings crx No CVEs detected; js_libraries_detected empty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Какаду VPN – яркий proxy с быстрым подключением [browser-hijack] + malext.io malicious_extension_sentry; score 5.67 -> 8.17 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy servers — critical capability for a VPN extension.

Pillar Scores

Bookkeeping