Top Risks

• Uninstall URL hijack redirects to nighteye.short.gy (3rd-party URL shortener); +3.0 webstore signal.
• Broad host access (*://*/*) combined with scripting and content_scripts on all URLs; dark-mode category partially justifies.
• 10 innerHTML DOM-XSS sinks across UI and content scripts; CSP is present but sinks remain exploitable via page-supplied data.
• No developer name listed in store; identity pillar elevated.
• 11 external JS hosts including imgbb.com and relayflow.promotino.com; >3 distinct registrable domains raises network concern.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL set to https://nighteye.short.gy/rdzkOC/# — 3rd-party URL shortener redirect.
• host_permissions_broad manifest *://*/* with content_scripts on <all_urls>; scripting permission compounds reach.
• dom_xss_sinks crx 10 innerHTML assignments from variables found across background, content, and popup JS files.
• external_hosts_count crx 11 distinct external hosts: billing.nighteye.app, imgbb.com, relayflow.promotino.com, social platforms.
• no_developer_name store developer_name field is empty; only email extensions@promotino.com is present.
• is_featured_by_google store Extension carries Google Featured badge, providing partial trust signal.
• privacy_policy_classification api Policy fetched, scoped to extension, discloses data collection, retention, and third-party sharing.
• cve_findings_raw crx No CVEs detected in bundled JS libraries.

Permissions Breakdown

• storage low Stores user preferences for dark mode settings.
• contextMenus low Adds right-click menu options; low standalone risk.
• activeTab low Scoped to current tab on user action; limited blast radius.
• tabs medium Can read tab URLs and titles across all tabs.
• scripting medium Injects scripts into pages; paired with host_permissions <all_urls> is significant.
• identity medium Can obtain OAuth tokens; risk depends on scopes requested at runtime.
• *://*/* high Broad host access on all URLs; content_scripts also on <all_urls>. Core to dark-mode function but high capability.

Pillar Scores

Bookkeeping