Top Risks

• proxy permission routes ALL browser traffic through spidervpn.online — unverified Russian-hosted SOCKS5 provider
• Privacy policy URL returns fetch error; policy effectively absent for scoring — score +10.0
• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous high-capability extension
• Only 16 installs with HIGH-tier permission (proxy) — classic tail-attack-surface / targeted deployment signal
• DOM-XSS sink (innerHTML) in servers.js without CSP protection increases exploit risk on proxy-intercepted pages

Evidence

• proxy_permission manifest proxy declared; can reroute all browser TCP connections to arbitrary SOCKS5 server.
• privacy_policy_fetch_error api Privacy policy at https://spidervpn.online/privacy returned HTTPError; treated as absent (+10.0).
• free_webmail_no_devname store developer_email=namikkm13@gmail.com, developer_name empty, no verified publisher badge.
• js_external_host_ru crx js_external_hosts=['spidervpn.online']; host_geo_diversity countries=['RU'].
• small_install_high_perm api install_perm_anomaly: 16 installs with has_high_tier_permission=true, small_install_high_perm=true.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in src/servers.js; no CSP present to mitigate.
• no_csp_mv3 manifest content_security_policy=null; csp_present=false on MV3 extension.
• wayback_no_snapshot api wayback_ownership: first_snapshot=null, fetch_error:ReadTimeout; dev domain history unverifiable.

Permissions Breakdown

• proxy high Full proxy control can redirect all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping