Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — ArachnoNet — Быстрый VPN-прокси [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes all browser traffic through spidervpn.online — single point of interception for unverified operator
• Privacy policy URL returns fetch error (HTTP error); policy effectively absent — privacy pillar scores maximum
• Free-webmail developer (gmail) with no dev name and no verified publisher — identity unverifiable
• Only 22 installs with HIGH-tier permission (proxy) — classic tail-attack surface anomaly

Evidence

• proxy_permission manifest proxy declared — full browser traffic rerouting capability with no host restrictions.
• privacy_policy_fetch_failed api spidervpn.online/privacy returned HTTPError; policy unreadable, treated as absent.
• free_webmail_no_dev_name store Developer email ezagirace763@gmail.com, developer_name empty, no verified publisher badge.
• small_install_high_perm store 22 installs with proxy (HIGH) permission — install_perm_anomaly.small_install_high_perm=true.
• js_external_host_ru crx Single external JS host spidervpn.online geolocated in RU; sole infrastructure for VPN proxy.
• no_csp manifest content_security_policy is null/absent on MV3 extension.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0 — static analysis found no malicious signals.
• wayback_no_history api No Wayback Machine snapshot found for dev domain; domain age CT lookup skipped (free webmail).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — ArachnoNet — Быстрый VPN-прокси [browser-hijack] + malext.io malicious_extension_sentry; score 5.42 -> 7.92 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Allows full rerouting of all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping