Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Super Mario Bros Classic Game [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack and install URL hijack both set — classic monetization/tracking shell pattern.
• Privacy policy fetched but NOT scoped to this extension, admits data collection AND third-party sharing → +10.0 privacy.
• Developer uses free-webmail (gmail) with no developer name and no verified business domain.
• External JS host poki.ee loaded by 38 JS files with no CSP — unconstrained remote script surface.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstalled and uninstall URL hooks present — strong monetization/tracking shell indicator.
• free_webmail_developer store Developer email classroom6x2@gmail.com, no developer name, no verified business domain.
• privacy_policy_generic_data_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D rule +10.0.
• external_js_host_poki.ee crx 38 JS files scanned; external host poki.ee loaded with no CSP — unconstrained remote script execution.
• no_csp_mv3 manifest content_security_policy is null; MV3 default CSP applies but no explicit CSP for extension pages.
• stale_update_18mo store Last updated February 2025, 18 months since update → maintenance score +6.0.
• low_rating store Rating 2.0 — below threshold but rating_count not confirmed >= 50, no multiplier applied.
• verified_publisher_with_free_webmail store verified_publisher=true but email is gmail; no domain match to policy URL, discount capped by stale+no-resolve signals.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Super Mario Bros Classic Game [divergent] + malext.io malicious_extension_sentry; score 5.07 -> 7.57 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping