Top Risks

• proxy permission allows full traffic redirection through unknown server gusentun.space (RU/NL hosted)
• Developer is anonymous free-webmail (gmail) with no name, no verified publisher — high impersonation/abandonment risk
• Privacy policy is Google's generic account policy, completely unscoped to this extension's data practices
• Extension contacts gusentun.space and t.me externally; gusentun.space is an opaque Russian-registered domain
• install_url_hijack=true: onInstalled opens a third-party URL, monetization/redirect indicator

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; unverified developer makes this critical.
• anonymous_dev_gmail store Developer email ekugabezu505@gmail.com, no developer name, no verified publisher badge.
• generic_privacy_policy store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• install_url_hijack crx install_url_hijack=true; extension opens third-party URL on install — monetization/redirect pattern.
• external_js_hosts crx js_external_hosts: gusentun.space (unknown RU-linked domain) and t.me (Telegram). Proxy + unknown host = traffic risk.
• no_csp manifest content_security_policy is null; no CSP protection despite external host contacts.
• small_install_high_perm api Only 58 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• geo_diversity crx JS hosts span NL and RU (country_count=2); gusentun.space is non-transparent Russian-region domain.

Permissions Breakdown

• proxy high Proxy can redirect all browser traffic through attacker-controlled servers, full traffic interception risk.

Pillar Scores

Bookkeeping