Top Risks

• Fake VPN impersonating StrongVPN brand using gmail dev account with no developer name — proxy permission routes all traffic.
• install_url_hijack redirects to securepulse.space on install — unknown third-party capture site.
• JS external hosts include app.myxavpn.pro, securepulse.space, t.me — unrelated to legitimate StrongVPN infrastructure.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing.
• Only 3 installs with high-tier proxy permission — classic tail-attack-surface / sleeper threat pattern.

Evidence

• install_url_hijack crx onInstalled opens securepulse.space — unknown third-party domain, not related to StrongVPN brand.
• free_webmail_dev_no_name store Developer email ekugabezu505@gmail.com with no developer name; numbered-alias pattern.
• proxy_permission manifest proxy declared; can redirect all browser traffic to any server controlled by developer.
• js_external_hosts crx Extension contacts app.myxavpn.pro, securepulse.space, t.me — none match legitimate StrongVPN domains.
• generic_privacy_policy store Privacy policy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• small_install_high_perm api Only 3 installs with proxy (HIGH) permission — anomalous tail-attack-surface indicator.
• host_geo_diversity crx JS hosts span NL and RU — Russia-hosted infrastructure for a purported US VPN brand is atypical.
• csp_absent_mv3 manifest No content_security_policy declared; MV3 provides defaults but external host contacts remain unconstrained.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled servers; critical capability for a fake VPN.

Pillar Scores

Bookkeeping