Top Risks

• proxy permission allows full rerouting of all browser traffic through attacker-controlled servers
• Install URL hijack opens pauktun.space — unknown third-party domain; potential traffic/data interception
• Privacy policy is Google's generic policy — no scope to this extension, admits data collection and 3rd-party sharing
• Free-webmail dev (gmail) with no developer name and no business website; unverifiable identity
• Only 50 installs with HIGH-tier permission (proxy) — classic tail attack-surface anomaly

Evidence

• proxy permission manifest HIGH-risk permission declared; can redirect all browser network traffic through arbitrary proxy servers.
• install URL hijack manifest onInstalled opens https://pauktun.space/ — a third-party domain with no verified business identity.
• js_external_hosts crx Extension contacts pauktun.space externally. Same domain as install hijack target.
• privacy policy mismatch store Policy URL is Google's generic policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer identity store Free-webmail dev (namikkm13@gmail.com), no developer name, not verified, not featured.
• small install + high perm anomaly api install_perm_anomaly: 50 installs with has_high_tier_permission=true; small_install_high_perm=true.
• host geo diversity crx All JS hosts located in Russia (RU). Relevant for a VPN/proxy extension claiming server diversity.
• no CSP manifest csp_present=false on MV3 extension; no content security policy declared.

Permissions Breakdown

• proxy high Controls all browser network traffic routing; can redirect to attacker-controlled servers.

Pillar Scores

Bookkeeping