Top Risks

• Broad host permissions (<all_urls> content script + http/https/file host perms) on a crypto wallet — high-value compromise target.
• Privacy policy (aptoslabs.com/privacy) does not scope to this extension despite admitting data collection and third-party sharing.
• No developer name listed in store; only email identity via support@petra.app.
• 300K installs × crypto wallet = extreme blast radius if supply-chain or update compromise occurs.
• External JS hosts include feross.org and t.me (Telegram CDN); non-first-party origins for a financial extension.

Evidence

• broad_host_permissions manifest host_permissions include file://*/* http://*/* https://*/* giving content-script access to all pages.
• verified_publisher store verified_publisher=true; developer domain petra.app resolves; email matches domain.
• privacy_policy_scope_mismatch api Policy fetched (115923 chars), data_collection+third_party_sharing true, scope_extension false — generic Aptos Labs policy.
• no_code_findings crx code_findings_raw empty; obfuscation_score 0.0; 18 JS files scanned cleanly.
• external_js_hosts crx Extension contacts api.vimeo.com, feross.org, t.me, localhost, www.googleapis.com — 3 countries.
• clean_threat_intel api bad_host_hits, affiliate_hits, monetization_hits all empty; no siblings in operator cluster.
• recently_updated store Last updated May 2026; months_since_update=1; no maintenance risk.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable JS libraries detected.

Permissions Breakdown

• storage low Stores wallet state locally; expected for a crypto wallet.
• tabs medium Can read tab URLs; necessary for dApp injection but adds surface.
• alarms low Scheduled background tasks; low standalone risk.
• identity low OAuth token access; limited scope risk without broad scopes declared.
• host_permissions: file://*/* + http://*/* + https://*/* high Broad host access enables content-script injection on all pages; justified for wallet dApp connectivity but high surface.
• content_scripts: <all_urls> high Injects JS into every page; critical for wallet but broad attack surface if compromised.

Pillar Scores

Bookkeeping