Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Огонь VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission grants full traffic interception capability to an unverified gmail developer with no business identity
• Privacy policy is Google's generic account policy — completely unscoped to this extension, admits data collection and 3rd-party sharing
• No developer name, free-webmail email only — zero accountability or identity verification
• Small install count (77) paired with HIGH-tier permission (proxy) — classic tail-attack-surface pattern

Evidence

• proxy_permission manifest proxy declared — allows full browser traffic rerouting; no host_permissions or content_scripts limit scope.
• developer_identity store Developer name empty; email is free Gmail (ezagirace763@gmail.com). No business identity, no verified publisher badge.
• privacy_policy_generic store Privacy URL points to Google account policy (479KB). scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0.
• small_install_high_perm api 77 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• free_webmail_dev store ezagirace763@gmail.com with no developer name and no business website raises Reputation floor per free-webmail rule.
• cve_findings_empty crx No CVEs detected; js_libraries_detected empty; code_findings_raw empty.
• wayback_no_history api Wayback check returned fetch_error; no prior ownership snapshot available to verify continuity.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Огонь VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.14 -> 7.64 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control over all browser traffic — can intercept, redirect, or monitor all HTTP(S) connections.

Pillar Scores

Bookkeeping