Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Хит VPN – быстрый proxy для ежедневного доступа [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through developer-controlled pauktun.space infrastructure
• Install URL hijack to pauktun.space on install — monetization/tracking shell indicator
• Privacy policy is unscoped Google policy admitting data collection and 3rd-party sharing (+10 privacy pillar)
• Unaccountable operator: free-webmail gmail, no developer name, no verified publisher, no business domain

Evidence

• proxy_permission manifest proxy permission declared — full control over all browser network routing, can intercept/redirect all traffic.
• install_url_hijack crx onInstalled opens https://pauktun.space/ — 3rd-party domain, monetization/tracking redirect pattern.
• js_external_host crx Extension contacts pauktun.space — same domain as install hijack target; unknown operator.
• privacy_policy_generic store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true). Triggers +10.0.
• developer_identity store Developer email aslikap21@gmail.com (free webmail), no developer name, no verified publisher badge.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 default applies but no explicit policy declared.
• small_install_high_perm api install_perm_anomaly: 37 installs with high-tier proxy permission — tail attack surface.
• single_ru_host crx JS external host geo: RU only. Single Russian-hosted endpoint for a VPN proxy extension with no accountability.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Хит VPN – быстрый proxy для ежедневного доступа [browser-hijack] + malext.io malicious_extension_sentry; score 4.41 -> 6.91 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Controls all browser network routing; can redirect all traffic through attacker-controlled server.

Pillar Scores

Bookkeeping