Top Risks

• Brand impersonation: mentions 'Shopify' but developer is unverified gmail account with no confirmed ownership.
• Privacy policy is Google's generic policy — scope_extension=false, data_collection=true, third_party_sharing=true → score +10.
• No CSP + broad host *://*/* + content_scripts on all Amazon domains; high exfil surface.
• Multiple files with hex-string obfuscation + function_constructor; code intent opaque.
• 12 distinct external JS hosts (mergeline.in, minta.ai, reconvert.io, tawk.to etc.) with 4-country geo diversity — unvetted supply chain.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[shopify], developer_email=gmail, confirmed_owner=false.
• generic_privacy_policy store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_host_permission manifest host_permissions=[*://*/*] combined with content_scripts on 40 Amazon URL patterns.
• no_csp crx content_security_policy=null on MV3 extension with external JS hosts and obfuscated code.
• obfuscation_hex_density crx 4 files flagged for hex-string obfuscation; obfuscation_score=0.2; function_constructor in jszip.min.js.
• external_js_hosts crx 12 distinct JS external hosts incl. mergeline.in, minta.ai, reconvert.io, www.tawk.to across 4 countries.
• install_perm_anomaly api small_install_high_perm=true: only 539 installs but has HIGH-tier host permission *://*/*.
• description_mismatch store Promises download but lacks 'downloads' permission — description_promise.mismatches non-empty.

Permissions Breakdown

• windows low Manages browser windows; limited standalone risk.
• system.display low Read display config; low abuse potential.
• identity medium Can access OAuth tokens; potential account risk.
• storage low Local extension storage only.
• tabs medium Access tab URLs and metadata across all sites.
• alarms low Scheduling only.
• history medium Full browsing history read access.
• *://*/* high Broad host permission — content scripts injected on all URLs including Amazon.

Pillar Scores

Bookkeeping