Top Risks

• Install URL hijack opens bitcoin-price.live/welcome on install; uninstall URL hijack also set — classic monetization/tracking shell behavior.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing. Scores +10.
• No developer name listed; unverified publisher; dev identity unaccountable.
• Extension 22 months stale (approaching 24mo band); no changelog visible.
• Manifest name/description use i18n placeholders — obfuscates true function in store listing.

Evidence

• install_url_hijack crx onInstalled opens https://bitcoin-price.live/welcome — classic traffic-monetization redirect (+2.0 Webstore).
• uninstall_url_hijack crx chrome.runtime.setUninstallURL set (target null in data but flag true) — +3.0 Webstore rule.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, 3rd_party_sharing=true → +10.0 Privacy (D rule).
• no_developer_name store developer_name is empty; no 'Offered by' accountability. +1.0 Reputation.
• stale_22mo store 22 months since last update; falls in 12-24mo band → +6.0 Maintenance.
• js_external_hosts crx Loads from bitcoin-price.live, getbootstrap.com, github.com, popper.js.org — 4 external hosts, MV3 so no MV2 CSP penalty.
• manifest_i18n_placeholders manifest manifest_name and manifest_description use __MSG__ placeholders — true function obscured from store scraping.
• low_installs_unverified store Only 229 installs; no verified publisher badge; elevated risk of abandoned or throwaway extension.

Permissions Breakdown

• alarms low Used to schedule periodic BTC price checks; low standalone risk.
• notifications low Displays price alerts; no host access pairing elevates risk.
• storage low Persists user preferences locally; low risk.

Pillar Scores

Bookkeeping