Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Proxy VPN – простой SOCKS5 proxy для Chrome [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through developer-controlled server (pauktun.space, RU-hosted)
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Developer is anonymous (no name, free-webmail gmail address) with no verified identity
• install_url_hijack active: onInstalled opens an external URL

Evidence

• proxy_permission manifest proxy declared — can redirect all browser network traffic to arbitrary SOCKS5 server.
• external_js_host crx js_external_hosts: [pauktun.space] — RU-hosted domain, unknown operator, not on bad-host list but unverified.
• install_url_hijack store install_url_hijack == true; opens external URL on install — monetization/tracking signal.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free-webmail gmail address (silviaferr79@gmail.com), no verified publisher.
• small_install_high_perm api 47 installs with proxy (HIGH-tier) permission — install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.
• geo_diversity crx All JS hosts in RU; single-country concentration for a proxy extension increases interception risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Proxy VPN – простой SOCKS5 proxy для Chrome [browser-hijack] + malext.io malicious_extension_sentry; score 4.52 -> 7.02 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can reroute all browser traffic through an arbitrary server; critical capability for interception.

Pillar Scores

Bookkeeping