Top Risks

• Extension not updated in 44 months — effectively abandoned, no security patches since Oct 2022.
• Privacy policy fetch failed; cannot confirm it covers this extension's data practices.
• No CSP on MV3 extension; minor risk amplifier for bundled react 16.13.1.
• React 16.13.1 is outdated but no CVEs detected in scan; worth monitoring.
• Stale maintenance window increases supply-chain takeover risk over time.

Evidence

• maintenance_stale store Last updated October 2022, 44 months ago — exceeds 36-month stale threshold (+10.0 maintenance).
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; policy URL present but unreachable — scored +10.0 privacy.
• no_csp crx content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• featured_by_google store is_featured_by_google=true; partial reputation signal applied.
• no_bad_hosts_or_affiliates api threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty.
• react_version crx Bundled react 16.13.1 detected; no CVEs found in cve_findings_raw.
• developer_domain_resolves api levelaccess.com resolves, looks_throwaway=false, legitimate accessibility vendor.

Permissions Breakdown

• storage low Stores local user preferences; no cross-site exposure.
• activeTab low Access only to currently focused tab on user gesture; narrow scope.
• scripting medium Can inject scripts into pages; paired with activeTab limits blast radius but still notable.

Pillar Scores

Bookkeeping