Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Хит VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through usachvpn.su (.su = Soviet Union ccTLD, opaque jurisdiction).
• Privacy policy is Google's generic policy — does not scope data collection to this extension at all; classified as admitting collection+3rd-party sharing without extension scope → Privacy pillar 10.
• Developer is anonymous (no name, free Gmail), small install count with high-impact permission flags install_perm_anomaly.
• install_url_hijack=true: extension opens an external URL on install, classic monetization/tracking vector.

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; VPN category partially justifies but anonymous dev + .su host amplifies risk.
• install_url_hijack crx install_url_hijack=true; extension fires external URL on install — tracking/monetization vector.
• js_external_host_su crx js_external_hosts=['usachvpn.su']; .su ccTLD with single RU-geolocated host, opaque operator.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy=10.
• anonymous_developer store developer_name empty, free Gmail (sedatkilli87@gmail.com), not verified publisher, not featured.
• small_install_high_perm api 85 installs with proxy (HIGH-tier) permission — tail attack surface anomaly flagged.
• host_geo_diversity crx Single JS host country: RU. Low diversity but all infra in Russia.
• no_cve_findings crx cve_findings_raw empty; no library CVEs detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Хит VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.11 -> 7.61 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full routing of browser traffic through attacker-controlled SOCKS5 servers; high-impact capability.

Pillar Scores

Bookkeeping