Top Risks

• Uninstall URL hijack and install URL hijack both present — classic traffic-monetization shell pattern.
• Privacy policy hosted on CDN subdomain, not scoped to this extension, yet admits third-party sharing.
• Free-webmail developer (gmail) with numbered alias, no verified business identity — minimal accountability.
• External JS hosts (cloudapi.stream, mines.cloudapi.stream) loaded at install with no CSP.
• Combination of redirect hijacks + external CDN hosting warrants manual inspection before enterprise allow.

Evidence

• install_url_hijack crx onInstalled opens https://cloudapi.stream/install/?reason= — classic monetization shell redirect.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to third-party target — traffic harvesting on uninstall.
• external_js_hosts crx JS loaded from cloudapi.stream and mines.cloudapi.stream with no CSP constraint.
• privacy_policy_scope store Policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true — generic CDN-hosted policy.
• developer_identity store Gmail address kiev3381917@gmail.com, no verified publisher, no business domain.
• numbered_alias_email store kiev3381917@gmail.com matches numbered-alias pattern associated with throwaway developer accounts.
• no_csp manifest content_security_policy is null; MV3 has default CSP but external JS hosts bypass it if loaded dynamically.
• low_installs_redirect_shell store Only 20 installs — newly deployed shell with install/uninstall URL hijacks typical of early-stage traffic operation.

Permissions Breakdown

• storage low Stores local game state; minimal risk in isolation.

Pillar Scores

Bookkeeping