Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry (+2.5, capped).
• Developer uses free Gmail address with no verified identity; no dev name listed.
• Privacy policy is only 83 chars, unscoped to this extension — effectively a stub.
• Extension last updated 27 months ago; stale for enterprise deployment.
• Brand impersonation: mentions Google/Zoom but developer is unaffiliated gmail user.

Evidence

• free_webmail_dev store Developer email zoomcorderhelp@gmail.com; no verified org, no developer name.
• privacy_policy_stub api Policy fetched but only 83 chars, scope_extension=false, data_collection=false — effectively empty.
• stale_extension store Last updated May 2024; 27 months since update — high abandonment risk.
• brand_impersonation store brand_mention.is_impersonation=true for Google; developer not confirmed owner.
• content_scripts_sensitive_domains manifest Content scripts injected into zoomgov.com — government video conferencing domain.
• no_code_findings crx code_findings_raw empty, obfuscation_score 0.0, no external hosts — clean scan.
• no_cve_findings crx jquery 3.6.0 bundled; cve_findings_raw empty — no known CVEs flagged.
• no_operator_cluster api sibling_count=0; no related suspicious extensions under same fingerprint.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry; score 4.66 -> 7.16 (+2.5 cap 2.5).

Permissions Breakdown

• content_scripts: *://*.gotomeeting.com/* medium Injects JS into GoToMeeting pages; limited to declared domain.
• content_scripts: *://*.gotowebinar.com/* medium Injects JS into GoToWebinar pages; limited to declared domain.
• content_scripts: *://*.meet.google.com/* medium Injects JS into Google Meet; matches stated function.
• content_scripts: *://*.zoom.us/* medium Injects JS into Zoom; limited to declared domain.
• content_scripts: *://*.zoomgov.com/* medium Injects JS into Zoom Gov; sensitive domain, limited to declared.

Pillar Scores

Bookkeeping