Top Risks

• Brand impersonation of legitimate Atlas VPN product by unknown gmail developer with no verified identity.
• proxy permission routes all browser traffic; install_url_hijack opens securepulse.space on install.
• Privacy policy is Google's own generic policy — does not scope to this extension at all (scope_extension=false, data_collection=true, 3rd-party sharing=true).
• Free-webmail developer (gmail), no developer name, no business website — zero accountability.
• External JS hosts include app.myxavpn.pro and securepulse.space (RU/NL geo-diversity) — suspicious for a VPN impersonator.

Evidence

• install_url_hijack crx onInstalled opens https://securepulse.space — 3rd-party URL hijack on install confirmed.
• brand_impersonation_manual store Extension named 'Atlas VPN' but developer is ekugabezu505@gmail.com with no verified publisher badge.
• free_webmail_no_devname store Developer email is gmail; developer_name is empty; no business website identifiable.
• proxy_permission manifest proxy declared — capable of redirecting all browser traffic through arbitrary server.
• generic_google_privacy_policy api Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx Extension contacts app.myxavpn.pro, securepulse.space, t.me — unrelated to Atlas VPN brand.
• host_geo_diversity api JS hosts span NL and RU — Russia-hosted infrastructure for a VPN brand impersonator.
• small_install_high_perm store Only 20 installs with HIGH-tier proxy permission — tail-attack-surface / honeypot pattern.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; maximum traffic interception capability.

Pillar Scores

Bookkeeping