Top Risks

• proxy permission enables full browser traffic redirection to attacker-controlled spidervpn.online infrastructure
• Privacy policy URL 404s (fetch_error) — no verifiable data handling disclosure for a VPN handling all traffic
• Free-webmail developer (gmail), no developer name, no verified publisher — anonymous operator
• Only 33 installs with HIGH-tier permission: tail-attack-surface risk if extension is targeted or sold
• External JS host is spidervpn.online (RU-hosted, unresolved domain age) — single opaque Russian backend

Evidence

• proxy_permission manifest proxy declared — can silently reroute all browser HTTP/HTTPS traffic through any server the extension specifies.
• privacy_policy_fetch_error crx https://spidervpn.online/privacy returned HTTPError; policy could not be evaluated — treated as no policy.
• free_webmail_no_dev_name store Developer email kameqoko032@gmail.com; developer_name is empty; no verified publisher badge.
• small_install_high_perm api 33 installs with proxy (HIGH-tier) — install_perm_anomaly.small_install_high_perm == true.
• js_external_host_ru crx Only external JS host is spidervpn.online, geo-resolved to RU. Single opaque backend for VPN extension.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit policy declared.
• no_obfuscation_no_code_findings crx obfuscation_score=0.0, code_findings_raw empty — no malicious code detected in 6 scanned JS files.
• wayback_no_history api wayback first_snapshot null; domain has no archive history — brand-new or obscure operator.

Permissions Breakdown

• proxy high Can redirect all browser traffic through an arbitrary proxy server — full network interception capability.

Pillar Scores

Bookkeeping