Top Risks

• Default search-engine override routes all user queries to trackingnumbers.org — classic search-hijack monetization pattern.
• Uninstall and install URL hijacks confirm aggressive traffic-capture behavior.
• Developer name 'USPS Tracking' mismatches extension title 'UPS Tracking' — possible brand-confusion tactic.
• Free-webmail dev (gmail) with no verified business identity; rating of 1.0 strongly negative.
• 16-month stale update with active search-provider override increases supply-chain / abandonment risk.

Evidence

• search_provider_override_default manifest chrome_settings_overrides.search_provider.is_default=true redirects all browser searches to trackingnumbers.org.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers an uninstall URL targeting a 3rd-party endpoint.
• install_url_hijack crx install_url_hijack=true; extension opens a 3rd-party URL on install.
• free_webmail_developer store Developer email morancharles916@gmail.com is free-webmail with no verified business presence.
• low_rating store Rating is 1.0 — worst possible; indicative of user harm or deceptive behavior.
• developer_name_mismatch store Developer listed as 'USPS Tracking' but extension is 'UPS Tracking' — likely brand-confusion tactic.
• stale_extension store Last updated May 2025; 16 months since update with an active default search override.
• no_csp manifest content_security_policy is null on MV3; no additional hardening applied.

Permissions Breakdown

• storage low Local key-value storage only; no cross-origin data exposure.
• host_permissions: *://trackingnumbers.org/* medium Scoped to single dev-controlled domain but enables outbound data flow to that host.
• chrome_settings_overrides.search_provider (is_default=true) high Silently replaces default search engine; routes all searches through trackingnumbers.org.

Pillar Scores

Bookkeeping