Top Risks

• proxy permission routes all browser traffic through spidervpn.online — unknown operator, high interception risk.
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Developer is anonymous (no name, free-webmail Gmail, no verified publisher), ultra-low install count (63) with HIGH-tier permission.
• JS external host spidervpn.online: single-country RU-hosted, no WHOIS data, throwaway-pattern domain.
• install_perm_anomaly: small_install_high_perm — 63 installs + proxy is a tail-attack-surface red flag.

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to spidervpn.online SOCKS5 servers.
• generic_privacy_policy store Privacy policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, developer_email aslikap21@gmail.com (free webmail), no verified publisher badge.
• external_js_host crx js_external_hosts: [spidervpn.online] — RU-hosted single domain, no threat-intel hits but unknown operator.
• small_install_high_perm api 63 installs with proxy permission flagged as small_install_high_perm by install_perm_anomaly.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• no_code_findings crx obfuscation_score=0.0, code_findings_raw empty — no malicious JS patterns detected in 5 scanned files.
• maintenance_ok store months_since_update=5, within 3-6 month band — minor staleness penalty.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled SOCKS5 server; critical capability.

Pillar Scores

Bookkeeping