Top Risks

• proxy permission routes ALL browser traffic through bystriyinterprdo.space — unknown Russian domain, trivial MITM surface.
• Install URL hijack opens bystriyinterprdo.space on install; only external JS host is same domain — unverifiable C2 risk.
• Privacy policy is Google's generic account policy — does not scope to this extension at all; data practices undisclosed.
• Developer is anonymous (no name, free-webmail gmail, no verified publisher) with only 8 installs — classic tail-attack-surface pattern.
• No CSP on MV3 extension with proxy capability and external host; code quality unverifiable beyond 2 scanned files.

Evidence

• install_url_hijack crx onInstalled opens https://bystriyinterprdo.space — unknown RU-hosted domain, same as sole JS external host.
• proxy_permission manifest proxy declared — can silently redirect all browser traffic; no host_permissions restrict scope.
• anonymous_developer store developer_name empty, email is qawoninoge92@gmail.com (free webmail, numbered alias pattern), no verified publisher.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to extension.
• small_install_high_perm api Only 8 installs with proxy (HIGH-tier) permission — install_perm_anomaly.small_install_high_perm=true.
• js_external_host_ru crx Single external JS host bystriyinterprdo.space geolocated RU; no bad_host_hits but domain unverifiable.
• no_csp manifest content_security_policy null; MV2 +2.0 network penalty does not apply (MV3) but no CSP with proxy is still concerning.
• numbered_alias_email store qawoninoge92@gmail.com matches numbered-alias pattern (+3.0 webstore per rubric).

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers — core VPN capability but highly abusable.
• storage low Stores extension settings locally; low standalone risk.

Pillar Scores

Bookkeeping