Top Risks

• proxy permission + gmail dev + no verified publisher: full traffic interception by anonymous operator
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing
• Install URL hijack opens routekeeper.space on install; t.me also in external hosts, no legitimate VPN need
• JS contacts app.myxavpn.pro (unrelated to stated routekeeper.space brand) — additional undisclosed backend
• 4 geo-diverse JS host countries (CA, NL, RU, US) including Russia; free-webmail dev with no business identity

Evidence

• proxy_permission manifest proxy declared — can redirect all browser traffic to any server chosen by the extension.
• install_url_hijack crx install_url_hijack=true; target=https://routekeeper.space/ opens on install.
• undisclosed_external_host crx js_external_hosts includes app.myxavpn.pro and t.me not listed in host_permissions.
• generic_privacy_policy store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, 3rd_party_sharing=true.
• free_webmail_no_dev_name store developer_email=milumepid39@gmail.com; developer_name empty; no verified publisher.
• geo_diversity api JS hosts span 4 countries: CA, NL, RU, US. Russia inclusion is elevated risk for VPN traffic routing.
• small_install_high_perm store Only 5 installs with HIGH-tier proxy permission; install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest csp_present=false on MV3 extension; no content_security_policy declared.

Permissions Breakdown

• proxy high Allows full rerouting of all browser traffic through attacker-controlled servers.
• https://routekeeper.space/* high Unknown third-party VPN backend; install hijack opens this URL on install.
• https://cloudflare-dns.com/* low Legitimate DNS-over-HTTPS provider; expected for a VPN/proxy extension.
• https://dns.google/* low Legitimate DNS-over-HTTPS provider; expected for a VPN/proxy extension.

Pillar Scores

Bookkeeping