Top Risks

• proxy permission routes ALL browser traffic through developer-controlled servers (cloudmask.space, app.getmyxa.com)
• install_url_hijack opens cloudmask.space on install — a known-pattern monetization shell redirect
• Privacy policy is Google's own policy (myaccount.google.com), completely unscoped to this extension; admits data collection + 3rd-party sharing
• Developer is anonymous (no name, free-webmail gmail), small install count with high-impact permission — tail attack surface
• JS contacts 3 external hosts in NL and RU, including Telegram (t.me) — opaque back-channel risk for a VPN claiming privacy

Evidence

• proxy_permission manifest proxy declared; extension can silently reroute all browser TCP traffic through cloudmask.space or app.getmyxa.com.
• install_url_hijack crx onInstalled opens https://cloudmask.space/ — classic monetization-shell redirect on install.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → D clause +10.
• anonymous_developer store developer_name empty, developer_email is free-webmail gmail. No verified publisher, no business domain.
• external_js_hosts crx js_external_hosts: app.getmyxa.com, cloudmask.space, t.me. Geo: NL + RU. Unexpected Telegram contact for a VPN.
• small_install_high_perm api install_perm_anomaly: 134 installs + proxy (HIGH tier) — tail attack surface flag.
• low_rating store Rating 1.0 (single review). No positive signals; combined with anonymous dev raises concern.
• no_csp manifest csp_present=false on MV3; v2b +2.0 network applied. No content_security_policy declared.

Permissions Breakdown

• proxy high Allows full control of browser network routing; can redirect all traffic through attacker-controlled infrastructure.

Pillar Scores

Bookkeeping