Top Risks

• proxy permission grants full traffic redirection capability to unverified gmail developer with no business identity.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack redirects to routekeeper.space on install; extension contacts app.myxavpn.pro and t.me externally.
• Developer is free-webmail with no name, no verified publisher status, and no business domain.
• geo-diverse JS hosts (CA, NL, RU, US) including Russian-geolocated endpoint for a low-install VPN extension.

Evidence

• proxy_permission manifest proxy declared — can reroute all browser traffic; HIGH risk for unverified VPN.
• install_url_hijack crx install_url_hijack=true; target=https://routekeeper.space/ on extension install.
• free_webmail_no_dev_name store developer_email=milumepid39@gmail.com; developer_name empty; no business website.
• generic_google_privacy_policy api Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts_include_myxavpn_and_telegram crx js_external_hosts includes app.myxavpn.pro and t.me — not listed in manifest host_permissions.
• geo_diversity_russia api JS hosts span CA, NL, RU, US (4 countries); RU-geolocated endpoint flagged for VPN with 158 installs.
• small_install_high_perm_anomaly api install_perm_anomaly: small_install_high_perm=true; 158 installs with proxy permission.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-chosen servers.
• https://routekeeper.space/* high Unknown third-party domain; used as install hijack target and proxy backend.
• https://cloudflare-dns.com/* low Legitimate public DNS-over-HTTPS endpoint; plausible for VPN DNS resolution.
• https://dns.google/* low Legitimate Google DNS-over-HTTPS; plausible for VPN DNS resolution.

Pillar Scores

Bookkeeping