Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Оса Щит — надёжная защита в сети [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through osavpn.su (RU-hosted), enabling MITM on every site visited
• Developer uses free Gmail with no dev name or business identity; anonymous operator of a traffic-interception tool
• Privacy policy is generic Google account policy — entirely unscoped to this extension's data practices
• Only 6 installs with a HIGH-tier permission (proxy): classic tail-attack-surface / test-stage malware pattern

Evidence

• proxy_permission manifest proxy declared — full control over all browser network traffic; paired with external host osavpn.su (RU).
• free_webmail_no_dev_name store Developer email silviaferr79@gmail.com; developer_name empty. Anonymous operator of a traffic-interception tool.
• generic_privacy_policy store Privacy policy URL is Google Account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• install_perm_anomaly api 6 installs + proxy (HIGH-tier): small_install_high_perm=true. Classic pre-deployment or malware-staging signal.
• external_js_host_ru crx js_external_hosts=[osavpn.su]; host geo: RU only. Proxy server and JS served from same unverified Russian domain.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy hardening declared.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false. No accountability signals present.
• privacy_policy_admits_third_party_sharing api Classification: data_collection=true, third_party_sharing=true, scope_extension=false → worst-case privacy score.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Оса Щит — надёжная защита в сети [browser-hijack] + malext.io malicious_extension_sentry; score 5.57 -> 8.07 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control over all browser traffic; can silently reroute all connections through attacker-controlled servers.

Pillar Scores

Bookkeeping