Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — VPN Cloak [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through stealthpath.space — unknown Russian-affiliated infrastructure (hosts in RU/NL/CA/US).
• Developer is anonymous gmail user (milumepid39@gmail.com) with no name, no verified publisher, no business identity.
• Privacy policy is Google's own policy — entirely unscoped to this extension; ADMITS data collection + third-party sharing by Google, not the extension operator.
• install_url_hijack opens stealthpath.space on install; JS contacts app.myxavpn.pro and t.me — two undisclosed external domains.

Evidence

• proxy_permission manifest proxy declared — full traffic interception capability with no verified operator identity.
• install_url_hijack crx onInstalled opens https://stealthpath.space/ — affiliate/tracking redirect on install.
• anonymous_gmail_dev store milumepid39@gmail.com, no developer name, not verified publisher, not featured.
• generic_google_privacy_policy store Privacy policy is Google account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx JS contacts app.myxavpn.pro and t.me — undisclosed endpoints not in host_permissions.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US — Russia-hosted infrastructure for a proxy extension.
• no_csp manifest content_security_policy null; MV3 default applies but no explicit CSP with broad network reach.
• description_russian store Description in Russian: 'скрытый proxy для Chrome с режимом невидимого подключения' — narrow Russian-market targeting.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — VPN Cloak [browser-hijack] + malext.io malicious_extension_sentry; score 6.07 -> 8.57 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control — can silently reroute all browser traffic through attacker-controlled infrastructure.
• https://stealthpath.space/* high Unknown third-party domain; install_url_hijack target; single dev-controlled host receiving proxy config.
• https://cloudflare-dns.com/* low DNS-over-HTTPS endpoint; legitimate for VPN/proxy DNS resolution.
• https://dns.google/* low DNS-over-HTTPS endpoint; legitimate for VPN/proxy DNS resolution.

Pillar Scores

Bookkeeping