Top Risks

• proxy permission routes ALL browser traffic through tarakanvpn.online — unknown Russian host with no accountability.
• Privacy policy is Google's own generic policy; it does not scope data collection to this extension at all (+10.0 privacy).
• Developer is free-webmail only (gmail), no name, no verified publisher — anonymous operator controlling traffic proxy.
• Only 36 installs but HIGH-tier permission (proxy) — tail-attack-surface / low-legitimacy signal.
• External JS host tarakanvpn.online is the sole VPN backend; no transparency, no disclosed infrastructure.

Evidence

• proxy_permission manifest Single HIGH permission 'proxy' — full traffic routing capability; VPN category provides justified-broad discount (-1.5).
• external_js_host crx js_external_hosts: ['tarakanvpn.online'] — unknown RU-hosted VPN backend; sole proxy server domain.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_dev_no_name store developer_email=aslikap21@gmail.com, developer_name empty, no verified publisher → reputation floor applies.
• small_install_high_perm api install_perm_anomaly: 36 installs + proxy (HIGH-tier) = small_install_high_perm true → +1.5 webstore.
• host_geo_diversity api country_count=1 (RU); below geo-diversity threshold, no penalty.
• no_csp manifest csp_present=false on MV3; MV3 has strict default so no v2 +2.0 MV2 penalty, but no additional CSP supplied.
• maintenance store months_since_update=5 → 3-6mo band → +1.5 maintenance score.

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled servers; can intercept, redirect, or suppress any request.

Pillar Scores

Bookkeeping