Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Мгновенный VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full interception of all browser traffic by unknown developer
• Developer is anonymous free-webmail Gmail account with no name, no verified publisher status
• Privacy policy is Google's generic account policy — entirely unscoped to this extension, admits data collection and 3rd-party sharing
• install_url_hijack: onInstall opens stealthpath.space — unknown throwaway-looking domain

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; VPN category provides partial discount but anonymous dev negates trust.
• free_webmail_no_devname store Developer email milumepid39@gmail.com, developer_name empty. Reputation floor applies.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0.
• install_url_hijack manifest onInstalled opens https://stealthpath.space/ — third-party domain, Webstore +2.0.
• small_install_high_perm_anomaly api 247 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true, +1.5 Webstore.
• js_external_hosts_russia_geo crx stealthpath.space resolves to RU geolocation alongside CA/US. 3 countries — below geo-diversity threshold of 4.
• no_csp manifest content_security_policy is null (MV3 default CSP applies; no additional network penalty for MV3).
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — code quality pillar 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Мгновенный VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.27 -> 7.77 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Redirects all browser traffic; complete network interception capability.
• https://stealthpath.space/* high Scoped to unknown third-party VPN backend domain with no verified owner.
• https://cloudflare-dns.com/* medium DNS-over-HTTPS access; legitimate for VPN but extends network reach.
• https://dns.google/* medium DNS-over-HTTPS access; legitimate for VPN but extends network reach.

Pillar Scores

Bookkeeping