Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Halloween Night Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL both hijacked to gameograf.com with UTM tracking — clear monetization shell pattern.
• Privacy policy URL points to Google's generic account policy (fetch failed); no extension-scoped policy exists.
• NewTab override combined with 'search' permission enables forced search monetization on every new tab.
• JS contacts instagram.com, netflix.com, youtube.com, x.com — social-media link farm typical of traffic-monetization shells.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM params — 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new tab for all users.
• operator_cluster_siblings store 7 siblings share same install/uninstall URL; 8 share same JS host set — industrial shell cluster.
• privacy_policy_unfetchable api Policy URL is Google account policy; fetch failed SSLError; no extension-scoped disclosure.
• js_external_hosts_social_media crx JS contacts instagram, netflix, youtube, x.com — link-farm pattern for traffic monetization.
• search_permission_newtab_combo manifest 'search' permission + newtab override enables forced search provider monetization.
• csp_absent_mv3 manifest No content_security_policy declared; MV3 default applies but no explicit hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Halloween Night Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.55 -> 8.05 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate search provider; paired with newtab override increases monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; primary vector for ad/affiliate monetization.

Pillar Scores

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

• hbcoidfefbocofajncopoidcoeedahbm
• ceaebmnkmaofbkkgilgmikncajiiohec
• bjgiiachhcnhldlbpcpblbghcafoakfl
• gdmbnkaaajldcmamodnkchdbnfonpjbb

Bookkeeping