Top Risks

• KNOWN-BAD-HOST: web.archive.org listed in URLHaus malware_download — js_external_hosts contains this domain
• jQuery 3.2.1 bundles 3 medium-severity CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); not patched to fixed_in 3.5.0
• Privacy policy on CDN domain (cdn.cloudapi.stream) not scoped to this extension; third_party_sharing=true with no retention disclosure
• Free-webmail developer (nadejdinv@gmail.com) with no verified publisher badge and opaque developer identity
• Sandbox CSP allows unsafe-inline and unsafe-eval; 12 external JS hosts referenced in extension files

Evidence

• known_bad_host crx web.archive.org in js_external_hosts; URLHaus flags 154.216.19.139 as malware_download (elf)
• cve_bundled_lib crx jquery@3.2.1 bundles CVE-2019-11358 (mod), CVE-2020-11022 (mod), CVE-2020-11023 (mod); fixed_in 3.5.0
• privacy_policy_inadequate store Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true
• free_webmail_developer store Developer email nadejdinv@gmail.com; no verified publisher; no business domain
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src
• external_js_hosts crx 12 external hosts referenced including bnjmnt4n.now.sh, createjs.com, stackoverflow.com, web.archive.org
• geo_diversity api JS hosts span 4 countries: CA, NL, US, ZA — meets +1.5 geo-diversity threshold for non-exempt category
• maintenance store Updated April 2026, 4 months ago — within 3-6 month band (+1.5)

CVE Exposures (4)

Pillar Scores

Bookkeeping