Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Andi: AI-Powered Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override sets andisearch.com as default engine — user search traffic rerouted.
• 28 months since last update (zombie extension) with no disclosed maintenance.
• Privacy policy fetched but scope_extension=false and data_collection=false — generic, not extension-scoped.
• No developer name listed; low accountability signal.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Andi Search as default engine with is_default=true, redirecting all searches.
• homepage_override manifest chrome_settings_overrides.homepage set to https://andisearch.com.
• stale_extension store Last updated April 4, 2024 — 28 months ago; qualifies as zombie (24-36mo band = +8.5).
• privacy_policy_generic api Policy fetched (1561 chars), scope_extension=false, data_collection=false — not scoped to this extension; +9.0 per v3 Fix A.
• shell_pattern_description store description_promise.is_shell_pattern=true; vague promise 'smarter, safer internet' mismatches search-override function.
• no_developer_name store developer_name is empty; reduces accountability; +1.0 Reputation.
• no_bad_hosts_no_cves api threat_intel bad_host_hits and cve_findings_raw both empty; no malicious signals detected.
• low_install_count store Only 1,000 installs; blast radius limited but not zero.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Andi: AI-Powered Search [browser-hijack] + malext.io malicious_extension_sentry; score 5.26 -> 7.76 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine to andisearch.com — medium-high capability per rubric rule (a).
• chrome_settings_overrides.homepage medium Redirects browser homepage to andisearch.com.

Pillar Scores

Bookkeeping