Top Risks

• Uninstall URL hijack redirects to developer's game portal — classic traffic-monetization pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Extension last updated 27 months ago — zombie extension with stale codebase.
• eval() found in bundled melonJS library on user-controlled input path — code execution risk.
• No developer name listed; install URL hijack opens internal game page on install.

Evidence

• uninstall_url_hijack crx Sets uninstall URL to https://www.play.gameograf.com/game/flappy-bird-old-style — 3rd-party traffic grab.
• install_url_hijack crx Sets install URL to /game/index.html — opens game page on install.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• stale_extension store Last updated June 2024; 27 months since update — zombie tier (+8.5).
• eval_user_input crx Direct eval() in melonJS-min.js on variable input — code quality risk.
• no_developer_name store developer_name is empty string — reduces accountability.
• verified_publisher store verified_publisher=true; discount capped at -1.0 due to months_since_update > 18 (invariant 0c/v3.5).
• install_url_hijack_webstore crx onInstalled opens 3rd-party URL pattern (+2.0 webstore).

Pillar Scores

Bookkeeping