Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Radmin Vpn — спокойный ре [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• proxy permission allows full traffic interception/redirection to neoncloak.space and app.myxavpn.pro — unknown third-party VPN backends
• install_url_hijack opens neoncloak.space on install — classic malicious onboarding redirect
• Gmail dev address, no developer name, no verified publisher — unaccountable identity
• Privacy policy is Google's own account policy — entirely unscoped to this extension; admits data collection and 3rd-party sharing

Evidence

• install_url_hijack crx onInstalled opens https://neoncloak.space/ — same domain as a JS external host; strong monetization/malware onboarding signal.
• proxy_permission manifest proxy declared; routes all browser traffic through operator-chosen servers (app.myxavpn.pro, neoncloak.space).
• js_external_hosts crx app.myxavpn.pro, neoncloak.space, t.me — two unknown VPN/proxy backends plus Telegram; geo: NL + RU.
• privacy_policy_generic store Policy URL is Google Account privacy policy — scope_extension=false, data_collection=true, third_party_sharing=true. Triggers +10.0 privacy (D rule).
• free_webmail_no_dev_name store developer_email=sedatkilli87@gmail.com, developer_name empty, verified_publisher=false — unverifiable identity.
• brand_impersonation_risk store Title uses 'Radmin VPN' — a real product by Famatech — but developer is unrelated gmail user; brand_mention.is_impersonation=false per scanner, flagged manually.
• no_csp manifest csp_present=false on MV3 extension; no content security policy declared.
• host_geo_diversity api JS hosts span NL and RU (count=2); below geo-diversity threshold but RU backend for proxy is elevated risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Radmin Vpn — спокойный ре [browser-hijack] + malext.io malicious_extension_sentry; score 4.68 -> 7.18 (+2.5 cap 2.5).

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; extremely high capability risk.

Pillar Scores

Bookkeeping