Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, but admits data collection and 3rd-party sharing.
• NewTab override replaces every new-tab page; high-reach surface for data exposure or monetization.
• 12 external JS hosts across 5 countries including CN/HK domains (go.aiyyx.com, www.aiyyx.com) with no CSP.
• No developer name listed; foxmail.com email provides limited accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to yuyi/index.html — replaces every new-tab page.
• generic_privacy_policy store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• no_csp manifest content_security_policy is null; csp_present=false. MV3 has strict defaults but no explicit CSP declared.
• external_hosts_geo_diversity crx 12 external JS hosts across 5 countries (CA,CN,HK,SG,US); go.aiyyx.com and www.aiyyx.com are unknown CN entities.
• dom_xss_sink crx innerHTML user-controlled assignment in index-JCUK_ghY.js; no CSP mitigates risk (+2.0 code quality).
• no_developer_name store developer_name is empty; foxmail.com is a free-webmail equivalent. Reputation +1.0.
• search_engine_baidu crx Only Baidu seen; search_engine_count=1, no multi-engine monetization anomaly.
• no_bad_hosts_no_affiliate api bad_host_hits, monetization_hits, affiliate_hits all empty; no threat-intel hits.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry; score 4.35 -> 6.85 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate search provider; medium risk for NewTab extensions.
• storage low Stores local extension data; standard and low risk.
• contextMenus low Adds items to context menu; low standalone risk.
• scripting medium Can inject scripts; risk depends on host_permissions (none declared here).
• declarativeNetRequest medium Can block/redirect network requests; no host permissions narrow scope.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for monetization or data collection.

Pillar Scores

Bookkeeping