Top Risks

• proxy permission: extension can reroute ALL browser traffic through neoncloak.space or myxavpn.pro under attacker control
• Install URL hijack opens neoncloak.space — unknown third-party domain used on every fresh install
• Privacy policy is Google's own policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no verified publisher — no accountability
• JS contacts neoncloak.space and app.myxavpn.pro (RU/NL hosted) — unrecognized infrastructure for a VPN claiming to be Radmin

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser HTTP/S traffic to any endpoint.
• install_url_hijack crx onInstalled opens https://neoncloak.space/ — same domain in js_external_hosts; unknown third party.
• external_hosts crx Extension contacts app.myxavpn.pro, neoncloak.space (NL/RU), t.me — none associated with legitimate Radmin brand.
• privacy_policy_generic store Policy is Google's own account privacy page (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_no_devname store Developer email namikkm13@gmail.com; developer_name empty; no verified publisher badge.
• small_install_high_perm api Only 43 installs but proxy (HIGH-tier) permission — tail attack surface anomaly flagged.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with proxy capability.
• geo_diversity crx JS hosts span NL and RU — two countries; unusual for a branded VPN product.

Permissions Breakdown

• proxy high Full proxy control — can redirect all browser traffic to attacker-controlled endpoints.

Pillar Scores

Bookkeeping