Top Risks

• Brand impersonation of ExpressVPN by unverified gmail dev with no dev name; proxy permission can route all traffic to securepulse.space/myxavpn.pro
• install_url_hijack opens securepulse.space on install — classic malware/affiliate landing pattern
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection & 3rd-party sharing) — scores 10
• JS contacts app.myxavpn.pro, securepulse.space, t.me — none affiliated with legitimate ExpressVPN; RU/NL geo diversity
• Free-webmail dev (gmail), no developer name, 346 installs with HIGH permission (proxy) — tail attack surface anomaly

Evidence

• brand_impersonation store Manifest name 'ExpressVPN' with gmail dev norkienej@gmail.com, no verified publisher, no dev name — clear impersonation.
• install_url_hijack manifest onInstalled opens https://securepulse.space — 3rd-party domain unrelated to ExpressVPN brand.
• proxy_permission manifest proxy permission allows full rerouting of all browser traffic to attacker-controlled endpoints.
• external_js_hosts crx JS contacts app.myxavpn.pro, securepulse.space, t.me — suspicious non-ExpressVPN domains including Telegram.
• privacy_policy_generic api Policy is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — D clause +10.
• free_webmail_no_devname store Developer norkienej@gmail.com, empty developer_name, no business website — reputation floor >=7.5.
• small_install_high_perm api 346 installs with proxy (HIGH) permission flagged by install_perm_anomaly.small_install_high_perm=true.
• geo_diversity crx JS hosts span NL and RU — 2 countries, moderate geo diversity for a VPN clone.

Permissions Breakdown

• proxy high Controls all browser network routing; can redirect all traffic to attacker-controlled servers.

Pillar Scores

Bookkeeping