Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Happ Plus [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full interception and redirection of all browser network traffic
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Developer is anonymous (no name, free webmail gmail address, no business domain)
• Only 49 installs with a HIGH-tier permission is a tail-attack-surface anomaly

Evidence

• proxy_permission manifest Declares 'proxy' — allows complete traffic interception/rerouting for all browser connections.
• generic_privacy_policy store PP URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• anonymous_developer store developer_name empty, email binoyihe32@gmail.com (free webmail), no business domain. Reputation floor applied.
• small_install_high_perm api install_perm_anomaly: 49 installs + has_high_tier_permission=true → small_install_high_perm=true.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false. No trust discount applicable.
• no_cve_no_bad_hosts crx cve_findings_raw empty, bad_host_hits empty, code_findings_raw empty. No active malware signals.
• cyrillic_description store Description in Russian describing SOCKS5 proxy config; category fits VPN/Proxy but dev identity unverifiable.
• no_external_js_hosts crx js_external_hosts empty, no remote code loading detected. Network behavior score 0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Happ Plus [browser-hijack] + malext.io malicious_extension_sentry; score 5.44 -> 7.94 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Proxy can intercept and redirect ALL browser traffic; highest-impact single permission.

Pillar Scores

Bookkeeping