Top Risks

• proxy permission routes ALL browser traffic through maskirovka.space — a Russian-registered domain with no business identity behind it
• install_url_hijack opens maskirovka.space on install; combined with NL/RU JS hosts this is a covert traffic-capture setup
• Privacy policy is Google's generic account policy — not scoped to this extension; classifies as data_collection+third_party_sharing with no extension scope
• Developer is anonymous (no name, free-webmail gmail, no verified publisher) with 21 installs — classic tail-attack-surface
• small_install_high_perm anomaly: only 21 installs but proxy (HIGH) permission; elevated risk of targeted compromise

Evidence

• proxy_permission manifest proxy declared — all browser traffic can be silently routed to app.myxavpn.pro / maskirovka.space
• install_url_hijack crx onInstalled opens https://maskirovka.space — a .space TLD domain with RU geo affinity, no business identity
• external_js_hosts crx JS contacts app.myxavpn.pro (NL), maskirovka.space (RU), t.me — 2 distinct geo regions, unknown operators
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true per classifier
• anonymous_developer store developer_name empty, free-webmail gmail, no verified publisher, no featured badge, 21 installs
• install_perm_anomaly api small_install_high_perm=true: 21 installs + HIGH-tier proxy permission — tail-attack-surface vector
• host_geo_diversity crx JS hosts span NL and RU; RU-geo endpoint (maskirovka.space) is also install-hijack target
• no_csp manifest csp_present=false on MV3; v2 rule +2.0 network not triggered for MV3 but absence noted alongside unknown hosts

Permissions Breakdown

• proxy high Routes all browser traffic through attacker-controlled server; core VPN capability but also highest exfil surface.

Pillar Scores

Bookkeeping