Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pure Safety [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all browser queries through pureextension.net, enabling traffic/ad monetization.
• No developer name listed; anonymous operator with generic admin@ email increases accountability risk.
• Privacy policy admits data collection and third-party sharing but omits retention period.
• Extension description ('safety level of websites') misaligns with primary function (search override), suggesting cloaking.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing all queries to pureextension.net/search/?...&s=e6pr
• no_developer_name store developer_name is empty string; no verified publisher badge; anonymous operator.
• privacy_third_party_sharing api Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• description_mismatch store Description promises website safety ratings; actual capability is search engine override only.
• zero_js_files crx js_file_count=0, code_findings_raw empty; extension delivers function entirely via search redirect.
• domain_split manifest Dev email domain purehubextension.net differs from search URL domain pureextension.net — two distinct domains.
• installs_1k_band store 10,000 installs; no verified publisher; webstore +1.0 for install count tier.
• cve_none crx cve_findings_raw is empty; no CVE exposure found.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pure Safety [browser-hijack] + malext.io malicious_extension_sentry; score 2.41 -> 4.91 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Forces default search engine to pureextension.net, redirecting all user queries; monetization risk.

Pillar Scores

Bookkeeping