Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cnote – Web Notes Clippin [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Developer email is qq.com free-webmail flagged as throwaway; no developer name supplied.
• install_url_hijack=true: extension opens a URL on install, potential tracking/adware signal.
• Small install base (134) with HIGH-tier host permission (<all_urls> + scripting) — tail attack surface.
• Privacy policy admits third-party data sharing but lacks data retention disclosure.

Evidence

• developer_email_throwaway store it_cwc@qq.com flagged looks_throwaway=true; no developer name; elevated-risk free-webmail identity.
• install_url_hijack crx install_url_hijack=true; target null but onInstalled opens 3rd-party URL — webstore +2.0.
• small_install_high_perm api 134 installs with <all_urls>+scripting+tabs; install_perm_anomaly.small_install_high_perm=true.
• dom_xss_sinks crx 3 innerHTML sinks in content scripts (pdfobject.min.js, RichTextEditor.js, floating-editor.js) — CSP present mitigates partially.
• privacy_policy_partial store Policy scoped, data_collection=true, third_party_sharing=true, retention=false — inadequate.
• js_external_hosts crx 6 external hosts including github.com, hertzen.com, pipwerks.mit-license.org; 2 countries only, geo-diversity low.
• verified_publisher store verified_publisher=true; discount applied but capped — throwaway email domain limits trust reduction.
• no_cve_findings crx cve_findings_raw empty; vue@3.5.39 bundled — no known CVEs flagged.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cnote – Web Notes Clippin [data-theft] + malext.io malicious_extension_sentry; score 3.19 -> 5.69 (+2.5 cap 2.5).

Permissions Breakdown

• contextMenus low Adds right-click menu items; limited risk.
• storage low Local data persistence; standard for note apps.
• activeTab low Access to current tab only on user action.
• sidePanel low UI panel; no data-access risk.
• scripting medium Programmatic script injection; elevated when paired with <all_urls>.
• tabs medium Can read tab URLs and metadata across all tabs.
• windows low Window management; low standalone risk.
• <all_urls> (host_permissions) high Broad host access enables content-script injection on every site visited.

Pillar Scores

Bookkeeping