Top Risks

• Instagram brand impersonation by unverified gmail developer with no business identity.
• Privacy policy is Google's own generic policy — does not scope data handling to this extension at all.
• Install URL hijack and uninstall URL hijack both present; redirect targets unknown.
• Operator cluster shows sibling extension under same gmail fingerprint — possible multi-extension spam.
• 16 months since last update; developer domain is free webmail with no accountability.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[instagram]; confirmed_owner=false; dev email is gmail.com.
• install_url_hijack crx install_url_hijack=true; uninstall_url_hijack=true; targets both null — destination unknown.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy; scope_extension=false; third_party_sharing=true.
• operator_cluster api sibling_count=1 under same gmail fingerprint; sibling_ids=[blicpdhhajlodleohohaeommdmpjfoab].
• free_webmail_developer store Developer email mujo.hydrov@gmail.com; no business website; no verified publisher badge.
• maintenance_stale store Last updated February 9, 2025; months_since_update=16; falls in 12-24mo band (+6.0).
• tos_violation manifest content_scripts on instagram.com; category MediaDownloader scraping major platform — ToS violation risk (+2.5).
• no_csp crx content_security_policy=null on MV3; no external JS hosts detected so no network amplifier triggered.

Permissions Breakdown

• storage low Used to persist user settings; low standalone risk.
• downloads medium Allows saving files to disk; matches stated download function.
• *://*.instagram.com/* medium Scoped host access to Instagram only; matches stated function but scrapes a major platform.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• blicpdhhajlodleohohaeommdmpjfoab

Bookkeeping