Top Risks

• Search-provider override sets viewpackagetracking.com as default engine, capturing all user queries.
• Uninstall and install URL hijacks confirm monetization shell pattern.
• Low rating (2.8) suggests poor user experience, consistent with search-hijacker behavior.
• Developer domain (onlinesearchtool.org) mismatches extension domain; generic org name raises trust concerns.
• No declared permissions but real capability exercised via settings override — intent mismatch.

Evidence

• search_provider_override manifest chrome_settings_overrides sets viewpackagetracking.com as default search engine (is_default=true).
• install_url_hijack crx onInstalled opens https://viewpackagetracking.com/extension-success/ — monetization/tracking on install.
• uninstall_url_hijack crx setUninstallURL registered; routes uninstall event to 3rd-party endpoint.
• low_rating store Rating 2.8 — below-average trust signal consistent with search hijacker user complaints.
• developer_domain_mismatch store Dev email domain onlinesearchtool.org differs from extension domain viewpackagetracking.com.
• no_verified_publisher store Not verified publisher, not featured; no trust anchors beyond self-hosted privacy policy.
• privacy_policy_adequate api Policy at viewpackagetracking.com/privacy.html is scoped, discloses collection, retention, third-party sharing.
• maintenance_stale store 9 months since last update (3-6mo band: +1.5, actually 6-12mo: +3.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Silently replaces default search engine; routes all queries through viewpackagetracking.com.
• uninstall_url_hijack medium Registers custom uninstall URL; low-grade hijack / tracking on removal.
• install_url_hijack medium Opens viewpackagetracking.com/extension-success/ on install; monetization/tracking signal.

Pillar Scores

Bookkeeping