Top Risks

• NewTab override with uninstall+install URL hijacks to haberikra.com — classic monetization/tracking shell pattern.
• Privacy policy URL timed out (fetch_error); policy effectively unavailable — scored as no policy (+10.0).
• bit.ly in js_external_hosts flagged as affiliate/cloaking redirector; destination hidden.
• mlionltd.github.io as external JS host is an unverified third-party GitHub page with no accountability.
• Months since update = 16; stale for a NewTab extension that overrides search and tracks installs/uninstalls.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with developer-controlled page.
• install_uninstall_hijack crx Both install and uninstall URLs redirect to haberikra.com with UTM tracking params.
• affiliate_hit crx bit.ly listed in js_external_hosts; threat_intel flags as affiliate/cloaking redirector.
• external_unverified_js_host crx mlionltd.github.io is an external JS host — unverified GitHub Pages, no publisher accountability.
• privacy_policy_unreachable api privacy_policy_classification.fetched=false, reason=fetch_error:ReadTimeout; policy unverifiable.
• no_csp manifest content_security_policy is null; no CSP protection on MV3 extension.
• stale_extension store Last updated April 2025; months_since_update=16 — moderately stale for active monetization shell.
• verified_publisher_no_developer_name store verified_publisher=true but developer_name is empty string; accountability gap.

Permissions Breakdown

• search medium Allows querying/overriding search; paired with NewTab override amplifies search monetization risk.
• chrome_url_overrides.newtab medium Replaces new tab page — primary vector for ad/search monetization.

Pillar Scores

Bookkeeping