Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Хит VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/redirection through unverified servers (app.getmyxa.com, RU-hosted).
• Developer is anonymous gmail user with no name, no verified publisher status — no accountability.
• Privacy policy is generic Google account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• install_url_hijack active — extension opens external URL on install (target unknown).

Evidence

• proxy_permission manifest proxy declared; can silently reroute all browser traffic to arbitrary servers.
• install_url_hijack manifest install_url_hijack=true; extension opens external URL on install, target not disclosed.
• external_js_hosts crx Contacts app.getmyxa.com (NL/RU geo) and t.me; neither is a known trusted CDN.
• anonymous_gmail_dev store Developer email ezagirace763@gmail.com, no developer name, no verified publisher, free webmail.
• generic_privacy_policy store Privacy policy URL is Google account policy — not scoped to this extension; data_collection+3rd_party_sharing=true.
• small_install_high_perm api 4 installs with proxy (HIGH-tier) — tail-attack-surface anomaly flagged.
• host_geo_diversity api JS hosts span NL and RU; RU-origin VPN proxy endpoint is elevated risk.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Хит VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.59 -> 8.09 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; full network interception capability.

Pillar Scores

Bookkeeping