Top Risks

• Privacy policy fetched but scope_extension=false AND admits data collection+third-party sharing: worst-tier privacy score.
• Broad content_script on *://*/* combined with scripting+https://*/* allows reading/modifying all web pages including banking/other wallets.
• Dynamic script creation and new Function() constructor in popup.js and sidepanel.js despite CSP; webpack pattern but still elevated.
• No developer name listed in store; rating 3.2 on 1M-install wallet extension is a meaningful trust signal concern.
• React 16.13.1 bundled (below 16.14 security baseline); 12 distinct external JS hosts including metaswap/codefi API and external blockchains.

Evidence

• broad_host_plus_scripting manifest host_permissions https://*/* + scripting + content_scripts *://*/* = full page read/write on every site.
• privacy_policy_worst_tier crx Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true: D(v3.5) → +10.0.
• dynamic_script_creation crx script_src_dynamic in popup.js and sidepanel.js; webpack chunk-loading pattern; CSP present mitigates remote loading.
• function_constructor crx new Function() in popup.js and sidepanel.js; likely webpack globalThis polyfill but still a code-quality flag.
• no_developer_name store developer_name is empty string in listing; +1.0 reputation penalty.
• low_rating_large_base store Rating 3.2 on 1M installs; rating_count unknown but volume suggests significant user dissatisfaction.
• external_hosts_count crx 12 distinct JS external hosts including gas-api.metaswap.codefi.network, blockchair.com, feross.org; >3 distinct domains.
• react_16_13_1 crx React 16.13.1 detected; below 16.14 patch level; no CVEs flagged in cve_findings_raw so CVE pillar stays 0.

Permissions Breakdown

• alarms low Schedules periodic tasks; low risk.
• tabs medium Can read tab URLs and metadata; medium risk.
• storage low Local data storage; low risk.
• clipboardWrite medium Can write to clipboard; relevant for crypto address copying.
• notifications low Can show desktop notifications; low risk.
• scripting high Can inject scripts into pages; combined with broad host access is high risk.
• sidePanel low Opens side panel UI; low risk on its own.
• gcm low Google Cloud Messaging for push; low risk.
• https://*/* high Broad host access to all HTTPS sites; high reach combined with scripting.
• http://localhost/* medium Access to localhost; typical for wallet RPC; medium risk.
• http://127.0.0.1/* medium Loopback access; same as localhost concern.
• http://0.0.0.0/* medium Wildcard loopback; slightly unusual; medium risk.
• content_scripts *://*/* high Content script injected on every page; can read/modify all page content.

Pillar Scores

Bookkeeping