Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Window Proxy [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception via attacker-controlled servers (app.myxavpn.pro, RU-hosted).
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Developer is unidentified: free webmail (gmail), no name, no verified publisher status.
• External JS hosts in NL and RU; unknown myxavpn.pro VPN backend could log all proxied traffic.

Evidence

• proxy_permission manifest proxy declared — grants ability to redirect all browser traffic through any server.
• external_hosts crx JS contacts app.myxavpn.pro (NL) and t.me (RU Telegram); unknown VPN backend.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• anonymous_developer store developer_name empty, free webmail aslikap21@gmail.com, no verified publisher badge.
• tiny_install_high_perm api install_perm_anomaly: 4 installs + proxy (HIGH tier) — tail-attack-surface deployment pattern.
• no_csp manifest content_security_policy is null; MV3 has strict defaults but no explicit CSP declared.
• geo_diversity crx JS hosts span NL and RU — 2 countries; below +1.5 threshold but adds context for proxy risk.
• no_bad_hosts_no_cves api threat_intel.bad_host_hits empty, cve_findings_raw empty — no known-bad infrastructure detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Window Proxy [browser-hijack] + malext.io malicious_extension_sentry; score 4.18 -> 6.68 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full control over browser proxy settings; can redirect all traffic through attacker-controlled endpoints.

Pillar Scores

Bookkeeping