Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Hourly to salary calculator​ + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing (D rule: +10.0).
• Uninstall URL hijack flag set and install URL redirects to developer domain that currently does not resolve.
• Developer domain hourlytosalarycalculator.app does not resolve; no developer name provided; no verified publisher badge.
• 21 months since last update; extension may be abandoned or unmaintained.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; target null — behavioural hijack flag present without confirmable destination.
• install_url_hijack crx install_url_hijack=true; redirects to https://hourlytosalarycalculator.app/welcome on install.
• developer_domain_not_resolving api threat_intel: hourlytosalarycalculator.app resolves=false; extension contacts this host via js_external_hosts.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers D rule +10.
• no_developer_name store developer_name is empty string; no verified publisher; no featured badge.
• stale_extension store 21 months since last update; in 12-24mo band (+6.0 maintenance).
• install_url_webstore_signal crx onInstalled opens 3rd-party URL (hourlytosalarycalculator.app/welcome): +2.0 webstore per rubric.
• uninstall_url_webstore_signal crx Uninstall URL hijack set: +3.0 webstore per rubric.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Hourly to salary calculator​ + malext.io malicious_extension_sentry; score 5.30 -> 7.80 (+2.5 cap 2.5).

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local data persistence only; no exfil path alone.

Pillar Scores

Bookkeeping