Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Formula Rush Racing Game [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack declared — extension redirects browser on removal to unknown third-party target.
• Install URL hijack on onInstalled — opens popup/index.html but pattern matches low-quality game-shell tactic.
• Privacy policy fetched from CDN domain (cdn.cloudapi.stream), scope_extension=false, third_party_sharing=true — rates +9.0.
• Free-webmail developer (nadejdinv@gmail.com), no developer name, no verified publisher — unaccountable identity.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag set — triggers +3.0 Webstore per rubric.
• install_url_hijack crx install_url_hijack=true targeting popup/index.html — game-portal shell pattern +2.0 Webstore.
• privacy_policy_scope api Policy on cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true → +9.0 Privacy.
• free_webmail_no_dev_name store developer_email=nadejdinv@gmail.com, developer_name empty, not verified — Reputation floor at 7.0.
• sandbox_csp_unsafe crx Sandbox CSP includes unsafe-inline and unsafe-eval on script-src — elevated code execution risk in sandboxed frames.
• js_external_hosts crx 10 distinct external hosts referenced: bnjmnt4n.now.sh, cloudapi.stream, createjs.com, getbootstrap.com, github.com, goo.gl, mths.be, popper.js.org, harrytheo.com, opensource.org.
• jquery_version crx jquery@3.5.1 bundled; no CVEs in cve_findings_raw — no CVE penalty applied.
• zero_permissions crx No declared permissions, host_permissions, or content_scripts — minimal capability footprint.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Formula Rush Racing Game [credential-theft] + malext.io malicious_extension_sentry; score 4.07 -> 6.57 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping