Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Redmin VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through gusentun.space — a throwaway Russian domain with no legitimacy signals.
• install_url_hijack: onInstalled opens https://gusentun.space, a 3rd-party domain with no verifiable publisher identity.
• Privacy policy is Google's own account policy — completely unscoped to this extension; admits data collection and 3rd-party sharing.
• Developer is anonymous gmail user with no name, no verified publisher status, and only 17 installs — extreme tail-attack-surface risk.

Evidence

• proxy_permission manifest proxy declared — can silently reroute all HTTPS traffic to gusentun.space (RU-hosted).
• install_url_hijack crx onInstalled opens https://gusentun.space — 3rd-party domain, monetization/C2 risk.
• js_external_host crx gusentun.space is the sole external JS host; single RU country, no CDN, no known-good registry.
• privacy_policy_generic store Policy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — v3.5 rule D: +10.
• free_webmail_no_dev_name store Developer email ezagirace763@gmail.com; no developer name; no verified publisher. Reputation floor >= 7.5.
• small_install_high_perm api 17 installs + proxy permission flagged by install_perm_anomaly.small_install_high_perm=true.
• geo_russia_only crx All JS hosts resolve to RU only; no transparency about proxy endpoints.
• no_cve_no_code_findings crx cve_findings_raw and code_findings_raw both empty; code quality scored 0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Redmin VPN [browser-hijack] + malext.io malicious_extension_sentry; score 6.07 -> 8.57 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; maximum network interception capability.

Pillar Scores

Bookkeeping