2048 Cupcakes
bebbjaeaajgmpgndeagilpdhfamikjbe
Risk Score
5.72
Risk Level:
Medium
Recommendation:
🟡 MEDIUM RISK — review
Top Risks
- 27 months stale (>24mo) with 20K installs — high abandonment/sale risk
- Privacy policy is generic Google policy, not scoped to extension; admits 3rd-party sharing
- Manifest source is HTML fallback (no CRX) with 20K installs — zero code visibility
- Developer uses free Gmail with no business identity
Evidence
- manifest_source_html_fallback store manifest_source == html_fallback with 20K installs; no manifest/code available
- stale_maintenance store Last updated July 30, 2024 (27 months ago) with >10K installs
- privacy_policy_generic api Policy URL is generic Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true
- developer_identity_weak store Developer email fredthedoggy101@gmail.com; no developer name or business website
- verified_publisher store Web Store verified publisher badge present
- featured_by_google store Featured badge present, but capped by stale >18mo (invariant 0c)
- empty_surface_area store manifest_source=html_fallback AND install_count>100K is false, but 20K installs with zero observable code still merits review
Pillar Scores
Permissions3.00
Reputation2.00
Network2.00
Webstore5.50
Maintenance8.50
Privacy10.00
Code Quality0.00
CVE Exposure0.00
Bookkeeping
Rubric v3.6
Scored at 2026-10-26 12:48
Listing SHA
c263b5bec05d…
Force block
— not fired
Score recovered
no
Elapsed
—