Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — тип топ Vpn — простой Pro [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission can route ALL browser traffic through cipherway.space — an unknown third-party server.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack opens cipherway.space on install — classic monetization/redirect shell pattern.
• Free-webmail developer (gmail), no developer name, no business website — unverifiable identity.

Evidence

• proxy_permission manifest proxy declared — routes all traffic; combined with external host cipherway.space this is critical.
• install_url_hijack store onInstalled opens https://cipherway.space/ — monetization/redirect shell signal.
• privacy_policy_generic store PP URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_no_devname store Developer email norkienej@gmail.com, developer_name empty — unverifiable identity, floor reputation ≥7.5.
• js_external_hosts crx Extension contacts app.getmyxa.com, cipherway.space, t.me — 3 distinct external domains including Telegram.
• small_install_high_perm api install_perm_anomaly: 150 installs + proxy permission — minimal community vetting, high tail risk.
• low_rating store Rating 2.3 — below acceptable threshold, suggesting user complaints.
• geo_diversity_RU_NL crx JS hosts span NL and RU — Russian-origin infrastructure warrants additional scrutiny for proxy traffic.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — тип топ Vpn — простой Pro [browser-hijack] + malext.io malicious_extension_sentry; score 5.69 -> 8.19 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect ALL browser traffic through an attacker-controlled server; critical capability for a VPN extension.

Pillar Scores

Bookkeeping