Top Risks

• Uninstall and install URL hijacks redirect to cloudapi.stream — classic monetization/adware shell pattern.
• Broad host_permissions (*://*/*) with no declared permissions[] and only 123 installs signals tail-attack surface.
• Gmail developer email with no verified identity; low-install high-perm anomaly flagged.
• JS external hosts (cachefly.cachefly.net, cloudapi.stream, top.rodeo) span 3 countries — unexplained network reach for a speed-test.
• Localized manifest name/description (__MSG_*) with no content_scripts — thin extension wrapper hiding actual function.

Evidence

• install_url_hijack crx onInstalled opens https://cloudapi.stream/install/?reason= — 3rd-party monetization domain.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to 3rd-party (target null but flag true).
• broad_host_permissions manifest host_permissions: [*://*/*] with empty permissions[] — full site access, no declared intent.
• js_external_hosts crx Loads from cachefly.cachefly.net, cloudapi.stream, top.rodeo — 3 external domains, 3 countries.
• small_install_high_perm api 123 installs + HIGH-tier permission (*://*/*) — install_perm_anomaly confirmed.
• free_webmail_dev store Developer email kiev3381917@gmail.com; no verified publisher; no business domain.
• localized_manifest manifest name/__MSG_name__ and description/__MSG_desc__ — obfuscated storefront identity.
• csp_absent manifest content_security_policy is null; MV3 defaults apply but no explicit CSP hardening.

Permissions Breakdown

• *://*/* high Broad host_permission grants access to all URLs; can read/modify traffic on every site.

Pillar Scores

Bookkeeping