Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Радмин ВПН – подходит для РФ [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/redirection through attacker-controlled zhuknet.online
• Install URL hijack opens zhuknet.online on install — unknown Russian domain, no business identity
• Privacy policy is Google's generic policy, completely unscoped to this extension; admits data collection & 3rd-party sharing
• Free-webmail developer (gmail), no developer name, no verified publisher — zero accountability

Evidence

• proxy_permission manifest proxy declared — can reroute all browser traffic to zhuknet.online or any host.
• install_url_hijack crx install_url_hijack=true, target=https://zhuknet.online — opens unknown RU domain on install.
• js_external_host crx js_external_hosts=[zhuknet.online] — extension loads/contacts Russian domain.
• privacy_policy_generic store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store developer_name empty, free Gmail address silviaferr79@gmail.com, no verified publisher.
• small_install_high_perm api 21 installs + proxy permission — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with external host contact.
• geo_diversity crx All JS hosts in RU only; single-country concentration aligned with VPN targeting Russian users.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Радмин ВПН – подходит для РФ [browser-hijack] + malext.io malicious_extension_sentry; score 6.03 -> 8.53 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through arbitrary proxy; maximum network interception capability.

Pillar Scores

Bookkeeping