Top Risks

• proxy permission gives full network routing control; combined with unknown backend at bystriyinterprdo.space (RU-hosted).
• Install URL hijack opens bystriyinterprdo.space on install — classic drive-by/monetization pattern.
• Developer is anonymous (no name, numbered Gmail alias icokarufig326) with no verified identity.
• Privacy policy is Google's own generic policy — not scoped to this extension; data practices completely opaque.
• Only 21 installs with a HIGH-tier permission (proxy) flags as tail-attack-surface anomaly.

Evidence

• install_url_hijack crx onInstalled opens bystriyinterprdo.space — unknown RU-hosted domain, monetization/malware risk.
• js_external_hosts crx Single external JS host: bystriyinterprdo.space (Russia). No known-bad hit but unverifiable operator.
• developer_identity store No developer name; email is numbered Gmail alias (icokarufig326@gmail.com) — high anonymity risk.
• privacy_policy store Privacy policy URL is Google's generic account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• proxy_permission manifest proxy declared — routes all browser traffic through operator-controlled servers.
• install_perm_anomaly api 21 installs + proxy (HIGH tier) = small_install_high_perm true; elevated tail-attack risk.
• host_geo_diversity crx JS host exclusively in Russia (RU). Single country, but high-sensitivity VPN context.
• no_csp manifest content_security_policy is null (MV3 default strict applies, but no explicit CSP declared).

Permissions Breakdown

• proxy high Full control over browser network traffic; core VPN capability but highly abusable.
• storage low Local key-value storage; minimal standalone risk.

Pillar Scores

Bookkeeping