Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Author Pics Default Search [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL is unreachable (fetch_error); effective no-policy state scores maximum privacy risk.
• Extension is 31 months stale with only 9 installs; no accountability or update path.
• No developer name listed; gmail-based dev email with no verified business identity.
• Default search provider override silently routes all user queries through author.pics.

Evidence

• search_provider_override manifest chrome_settings_overrides sets author.pics as default search engine (is_default=true); all queries redirected.
• privacy_policy_fetch_failure api privacy_policy_classification.fetched=false (ConnectionError); policy URL unreachable — treated as no policy.
• stale_extension store Last updated January 2024; 31 months since update with only 9 installs.
• free_webmail_dev store Developer email darkmodemaster.com@gmail.com is a gmail account; no developer name provided.
• no_js_files crx js_file_count=0; no code surface to scan — extension is purely manifest-driven search override.
• no_bad_hosts api threat_intel.bad_host_hits empty; no monetization or affiliate hits detected.
• operator_cluster api sibling_count=0; no related extensions under same fingerprint.
• cve_clean crx cve_findings_raw empty; no bundled JS libraries detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Author Pics Default Search [adware] [divergent] + malext.io malicious_extension_sentry; score 5.65 -> 8.15 (+2.5 cap 2.5).

Permissions Breakdown

• *://*.author.pics/* low Scoped only to dev's own domain; consistent with search provider function.
• chrome_settings_overrides.search_provider (is_default=true) medium Sets author.pics as default search engine; silently redirects all user queries.

Pillar Scores

Bookkeeping