Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Market Sniper [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection and 3rd-party sharing) — scores maximum privacy risk.
• Developer uses free webmail (hotmail.com) with no developer name and no business website.
• Uninstall URL hijack detected — extension redirects on uninstall to 3rd-party URL.
• Backend on free pythonanywhere.com hosting with no privacy scoping; potential exfiltration surface.

Evidence

• privacy_policy_generic store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy score.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() detected; uninstall_url_hijack=true raises webstore risk.
• free_webmail_dev store Developer email godoyozeias@hotmail.com; no developer name; no business website.
• free_hosting_backend manifest host_permissions include pythonanywhere.com — free-tier backend with no privacy accountability.
• verified_publisher store verified_publisher=true; however, free-webmail email and 3 installs limits trust value.
• install_count_minimal store Only 3 installs; no rating data available.
• cve_findings_empty crx No CVEs detected; no JS libs flagged.
• code_findings_empty crx No suspicious code patterns; obfuscation_score=0.0; 4 files scanned.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Market Sniper [adware] [divergent] + malext.io malicious_extension_sentry; score 2.68 -> 5.18 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data storage, low risk.
• unlimitedStorage low Extends storage quota; minimal additional risk.
• https://lista.mercadolivre.com.br/* low Scoped to single MercadoLivre domain matching stated Shopping function.
• https://extensionpay.com/* low Known payment service for Chrome extensions; limited scope.
• https://godoyozeias.pythonanywhere.com/* medium Developer-controlled free-hosting backend; data exfil surface without privacy scoping.

Pillar Scores

Bookkeeping