Top Risks

• Uninstall and install URL hijacks track user lifecycle to gameograf.com for monetization.
• Privacy policy URL (haberikra.com) timed out — no policy effectively disclosed; score 10.0.
• NewTab override with search permission and bit.ly affiliate host indicates ad-monetization shell.
• mlionltd.github.io external JS host is an unrecognized third-party surface with no accountability.
• 16 months since update — stale for an active product; verified-publisher discount capped per invariant 0c (stale >18mo does not apply, but policy fetch failure is disqualifying).

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking — classic monetization shell install hook.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM — +3.0 webstore per rubric.
• privacy_policy_fetch_failed api haberikra.com/privacy-policy/ returned ReadTimeout; treated as fetched==false → privacy pillar 10.0.
• affiliate_hit crx bit.ly listed in js_external_hosts; flagged as affiliate/cloaking redirector by threat_intel.
• newtab_override manifest chrome_url_overrides.newtab = index.html — NewTab replacement with search permission.
• external_unknown_host crx mlionltd.github.io is an unrecognized GitHub Pages host serving JS to 192-install extension.
• no_developer_name store developer_name is empty string — no 'Offered by' identity visible on store listing.
• verified_publisher_stale store Verified publisher but policy unreachable and 16mo stale; discount limited per 0c.

Permissions Breakdown

• search medium Allows overriding search provider; medium monetization risk in a NewTab extension.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary delivery vector for fan/wallpaper monetization shells.

Pillar Scores

Bookkeeping