Top Risks

• proxy permission routes ALL browser traffic through developer-controlled echosecure.space with no accountability.
• Install URL hijack opens echosecure.space on install — unknown third-party site collecting install telemetry.
• Privacy policy is Google's generic policy, not scoped to this extension; data collection and 3rd-party sharing admitted.
• Developer is anonymous (no name, free-webmail gmail, no verified publisher) with a VPN routing all traffic.
• Only 25 installs with a HIGH-impact permission (proxy) — tail-attack-surface risk; extension could be repurposed.

Evidence

• proxy_permission manifest proxy declared — can silently reroute all HTTP/HTTPS traffic through echosecure.space or any attacker server.
• install_url_hijack crx install_url_hijack=true; target=https://echosecure.space/ — unknown domain receives install event callback.
• js_external_hosts crx JS contacts echosecure.space — RU-hosted, unverified domain; single country (RU) in geo-diversity check.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• anonymous_developer store developer_name empty, free-webmail (gmail), no verified publisher, no featured badge.
• small_install_high_perm api 25 installs + proxy (HIGH) — install_perm_anomaly.small_install_high_perm=true; low visibility, high capability.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• free_webmail_no_business store namikkm13@gmail.com — numbered-alias pattern on free-webmail with no resolvable business domain.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; maximum network interception risk.

Pillar Scores

Bookkeeping