Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer is a free-webmail (Gmail) account with no verified business identity.
• Content script runs on <all_urls> giving broad page-read capability despite minimal declared permissions.
• No CSP declared; MV3 mitigates eval-injection but inline-DOM risks remain unmitigated.
• Verified publisher badge present but privacy posture is very weak; low install base limits trust signal.

Evidence

• content_scripts_matches=<all_urls> manifest Script injected on every site; broad reach for a dark-mode tool.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_email_free_webmail store darkmodeforwebsite@gmail.com — no verified business domain.
• verified_publisher=true store Chrome Web Store verified publisher badge present; partial trust credit.
• no_csp manifest content_security_policy is null; MV3 provides some default protection.
• code_findings_empty crx No suspicious code patterns found in 2 scanned JS files.
• threat_intel_clean api No bad hosts, affiliate hits, or monetization hits detected.
• maintenance_3-6mo store Last updated December 18, 2024; ~6 months ago — borderline stale.

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; limited scope.
• scripting medium Allows injecting scripts; medium risk but needed for dark-mode function.
• storage low Local preference storage; low risk.
• content_scripts <all_urls> high Runs on every page the user visits; broad reach for a styling extension.

Pillar Scores

Bookkeeping