Top Risks

• proxy permission allows full traffic interception/redirection through unverified servers (app.getmyxa.com, RU-hosted).
• Developer is anonymous gmail user with no name, no verified publisher status — no accountability.
• Privacy policy is generic Google account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• install_url_hijack active — extension opens external URL on install (target unknown).
• Only 4 installs with a HIGH-tier permission: tail-attack-surface / staging-for-targeted-deployment pattern.

Evidence

• proxy_permission manifest proxy declared; can silently reroute all browser traffic to arbitrary servers.
• install_url_hijack manifest install_url_hijack=true; extension opens external URL on install, target not disclosed.
• external_js_hosts crx Contacts app.getmyxa.com (NL/RU geo) and t.me; neither is a known trusted CDN.
• anonymous_gmail_dev store Developer email ezagirace763@gmail.com, no developer name, no verified publisher, free webmail.
• generic_privacy_policy store Privacy policy URL is Google account policy — not scoped to this extension; data_collection+3rd_party_sharing=true.
• small_install_high_perm api 4 installs with proxy (HIGH-tier) — tail-attack-surface anomaly flagged.
• host_geo_diversity api JS hosts span NL and RU; RU-origin VPN proxy endpoint is elevated risk.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; full network interception capability.

Pillar Scores

Bookkeeping