Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — VPN Bolt [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission lets extension reroute ALL browser traffic through routekeeper.space — unknown, unverifiable operator.
• install_url_hijack: onInstalled opens https://routekeeper.space/ — classic C2/monetization callback pattern.
• Privacy policy is Google's own policy (generic, unscoped); extension data handling completely undisclosed.
• Developer is anonymous (no name, free-webmail gmail) with only 6 installs — tail-attack-surface profile.

Evidence

• proxy_permission manifest proxy declared — can silently reroute all browser HTTP/HTTPS traffic to routekeeper.space.
• install_url_hijack crx onInstalled opens https://routekeeper.space/ — beacon/C2 callback on every fresh install.
• external_hosts_suspicious crx JS contacts app.myxavpn.pro and t.me — neither disclosed nor justified by stated VPN function.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store No developer name; gmail address milumepid39@gmail.com; free-webmail + no business website.
• small_install_high_perm api Only 6 installs with HIGH-tier proxy permission — install_perm_anomaly.small_install_high_perm=true.
• geo_diverse_hosts crx JS hosts span 4 countries: CA, NL, RU, US — atypical for a simple VPN proxy extension.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit CSP hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — VPN Bolt [browser-hijack] + malext.io malicious_extension_sentry; score 6.17 -> 8.67 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Full proxy control; can reroute all browser traffic through attacker-controlled server.
• https://routekeeper.space/* high Unknown third-party domain; install hijack redirects here; opaque operator.
• https://cloudflare-dns.com/* low Legitimate DNS-over-HTTPS provider; expected for VPN DNS resolution.
• https://dns.google/* low Legitimate Google DNS-over-HTTPS; expected for VPN DNS resolution.

Pillar Scores

Bookkeeping