Top Risks

• proxy permission routes ALL browser traffic through neoncloak.space (RU/NL hosted) — full MITM capability
• install_url_hijack opens neoncloak.space on install — classic traffic-monetization/malware delivery pattern
• Gmail dev with no dev name, no verified publisher — zero accountability
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection & 3rd-party sharing
• Only 62 installs with HIGH-tier proxy permission — classic tail-attack-surface / targeted deployment

Evidence

• proxy_permission manifest proxy declared — full browser traffic interception capability for a 62-install unknown VPN.
• install_url_hijack crx onInstalled opens https://neoncloak.space/ — same domain as JS external host; traffic monetization pattern.
• js_external_hosts crx Contacts app.myxavpn.pro, neoncloak.space (NL/RU), t.me — three distinct domains including Telegram.
• free_webmail_no_devname store Developer email imawocigi29@gmail.com, no developer name — numbered-alias free-webmail pattern.
• privacy_policy_generic store Privacy policy is Google's account policy — scope_extension=false, data_collection=true, 3rd_party_sharing=true.
• small_install_high_perm api 62 installs + proxy permission flagged as install_perm_anomaly.small_install_high_perm=true.
• host_geo_diversity crx JS hosts span NL and RU — two countries; RU-hosted VPN backend raises jurisdiction risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restrictions declared.

Permissions Breakdown

• proxy high Full proxy control allows rerouting all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping