Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pipl VPN [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission routes ALL browser traffic through developer-controlled infrastructure — highest-risk single permission.
• Privacy policy is Google's own generic policy; scope_extension=false, data_collection=true, third_party_sharing=true — effectively no extension-scoped policy.
• Developer is anonymous free-webmail (gmail), no name, no verified business; classic throwaway-account pattern.
• install_url_hijack=true: extension opens 3rd-party URL on install (app.getmyxa.com / t.me external hosts present).

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; combined with external host app.getmyxa.com this is a critical capability.
• install_url_hijack manifest install_url_hijack=true; js_external_hosts include app.getmyxa.com and t.me — monetization/redirect risk.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, third_party_sharing=true.
• free_webmail_anonymous_dev store Developer email sedatkilli87@gmail.com, developer_name empty, no verified publisher, no featured badge.
• geo_diversity crx JS hosted in NL and RU (country_count=2); RU jurisdiction adds geopolitical interception risk for a VPN.
• small_install_high_perm api 47 installs with proxy permission; install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 defaults apply but no explicit CSP declared.
• cve_findings_raw_empty crx No CVEs detected in bundled libraries; cve_findings_raw=[].
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pipl VPN [browser-hijack] + malext.io malicious_extension_sentry; score 5.57 -> 8.07 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Controls all browser network traffic routing; extreme capability for a VPN but also highest-risk permission.

Pillar Scores

Bookkeeping