Top Risks

• proxy permission routes all browser traffic through bezopasnet.space/.myxavpn.pro — unknown/unvetted infrastructure in NL+RU.
• install_url_hijack opens bezopasnet.space on install — third-party URL redirect on installation.
• Privacy policy is Google's own policy (myaccount.google.com) — completely unscoped to this extension; admits data collection and 3rd-party sharing.
• Developer is anonymous (no name, free-webmail Gmail, no verified publisher), tiny install base with high-capability permission.
• small_install_high_perm anomaly: 149 installs with proxy permission signals targeted/experimental malicious payload.

Evidence

• install_url_hijack manifest onInstalled opens https://bezopasnet.space/ — 3rd-party domain, not developer's verified domain.
• proxy_permission manifest proxy declared — can redirect all browser traffic to arbitrary servers including app.myxavpn.pro and bezopasnet.space.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's policy, not this extension's. scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free-webmail Gmail (namikkm13@gmail.com), no verified publisher, no featured badge.
• js_external_hosts crx Extension contacts app.myxavpn.pro, bezopasnet.space, t.me — 3 distinct registrable domains, including Telegram and RU-hosted infra.
• small_install_high_perm api install_perm_anomaly: 149 installs with proxy (HIGH-tier) permission — tail attack surface.
• geo_diversity api JS hosts in NL and RU — two countries; RU-hosted infra for a VPN is elevated risk.
• rating_1 store Rating of 1/5 — lowest possible; very few users, negative signal on trustworthiness.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled server; core VPN function but extreme capability.

Pillar Scores

Bookkeeping