Top Risks

• proxy permission allows full browser traffic redirection to attacker-controlled pauktun.space infrastructure
• install_url_hijack fires pauktun.space on install — monetization/phishing redirect pattern
• Privacy policy is Google's generic policy: not extension-scoped, admits data collection and third-party sharing
• Gmail developer, no name, no verification — unaccountable operator; throwaway identity pattern
• 21 installs + HIGH proxy permission = tail-attack sleeper profile; low visibility limits detection

Evidence

• proxy_permission manifest Extension declares 'proxy' — full control over browser network routing; can intercept all HTTP/S traffic.
• install_url_hijack store onInstalled opens https://pauktun.space/ — same domain as js_external_hosts; classic monetization/phishing redirect.
• generic_privacy_policy store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email sedatkilli87@gmail.com, developer_name empty, not verified publisher, not featured.
• small_install_high_perm api 21 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• external_host_pauktun_space crx js_external_hosts=['pauktun.space']; same domain as install hijack target; single RU-geolocated host.
• no_csp manifest content_security_policy is null; MV3 provides strict default but no explicit policy declared.
• geo_diversity crx All JS hosts in RU only; single-country concentration consistent with regionally targeted proxy infrastructure.

Permissions Breakdown

• proxy high Allows full control of browser network routing; can intercept/redirect all traffic.

Pillar Scores

Bookkeeping