Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

Halloween Night Live Wallpaper

aijplginpngbkakdlhnjjgmigncndbed
Risk Score
5.55
Risk Level: Medium
Recommendation: 🟡 MEDIUM RISK — review
Category NewTab
Installs 560
Rating 5.0
Last updated 2026-07-04 (2 months ago)
Manifest version MV3
CSP present ❌ no
Developer info@ovkas.com
Verified publisher ❌ no
Featured by Google ❌ no
Privacy policy link
Web Store open ↗

Top Risks

  • Uninstall and install URL both hijacked to gameograf.com with UTM tracking — clear monetization shell pattern.
  • Privacy policy URL points to Google's generic account policy (fetch failed); no extension-scoped policy exists.
  • NewTab override combined with 'search' permission enables forced search monetization on every new tab.
  • JS contacts instagram.com, netflix.com, youtube.com, x.com — social-media link farm typical of traffic-monetization shells.
  • Operator cluster shows 7 siblings sharing same install/uninstall URLs — industrial-scale NewTab monetization operation.

Evidence

  • uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM params — 3rd-party redirect on uninstall.
  • install_url_hijack manifest onInstalled opens gameograf.com with UTM params — 3rd-party redirect on install.
  • newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new tab for all users.
  • operator_cluster_siblings store 7 siblings share same install/uninstall URL; 8 share same JS host set — industrial shell cluster.
  • privacy_policy_unfetchable api Policy URL is Google account policy; fetch failed SSLError; no extension-scoped disclosure.
  • js_external_hosts_social_media crx JS contacts instagram, netflix, youtube, x.com — link-farm pattern for traffic monetization.
  • search_permission_newtab_combo manifest 'search' permission + newtab override enables forced search provider monetization.
  • csp_absent_mv3 manifest No content_security_policy declared; MV3 default applies but no explicit hardening.

Permissions Breakdown

  • search medium Can manipulate search provider; paired with newtab override increases monetization risk.
  • chrome_url_overrides.newtab medium Replaces every new tab with extension page; primary vector for ad/affiliate monetization.

Pillar Scores

Permissions3.00
Reputation5.00
Network2.00
Webstore10.00
Maintenance0.00
Privacy10.00
Code Quality0.00
CVE Exposure0.00

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

Bookkeeping

Rubric v3.6
Scored at 2026-09-15 17:46
Listing SHA db2b1482638d…
Force block — not fired
Score recovered no
Elapsed