Top Risks

• proxy permission allows full interception and redirection of all browser traffic with no accountability.
• Privacy policy URL returns HTTP error — policy effectively absent, maximum privacy risk.
• Developer is anonymous (no name, free Gmail, no verified publisher) running infra hosted in Russia.
• Only 19 installs with a HIGH-tier permission is a classic tail-attack-surface signal.
• No CSP on MV3 extension communicating with tarakanvpn.online (single Russian-hosted endpoint).

Evidence

• proxy permission declared manifest proxy is a HIGH-risk permission enabling full traffic routing; appropriate for VPN but from unverifiable dev.
• privacy policy fetch failed api privacy_policy_classification.fetched=false, reason=fetch_error:HTTPError → scored as absent (+10.0).
• free webmail developer, no name, no verified publisher store binoyihe32@gmail.com, developer_name='', verified_publisher=false → Reputation base high.
• very low install count with high-tier permission store 19 installs + proxy permission; install_perm_anomaly.small_install_high_perm=true.
• JS external host in Russia only crx js_external_hosts=[tarakanvpn.online], host_geo_diversity.countries=[RU], country_count=1.
• no content security policy manifest csp_present=false on MV3 extension; v2 fix (b) applied: +2.0 Network for MV2 not applicable, no extra penalty.
• no code findings or obfuscation crx code_findings_raw=[], obfuscation_score=0.0; code quality scored 0.
• wayback / domain age data unavailable api wayback fetch timeout; domain_age_ct not queried (free webmail). Cannot clear ownership history.

Permissions Breakdown

• proxy high proxy can intercept and redirect all browser network traffic — extreme capability for a VPN.

Pillar Scores

Bookkeeping