Top Risks

• Anonymous gmail developer with no business identity or verified publisher status.
• Privacy policy on suspicious free-hosting domain (resourceful-rat.static.domains) with no extension-scoped disclosure.
• DOM-XSS sink (innerHTML with user-controlled variable) present in main.js with no CSP protection.
• Extension is 17 months stale — approaching abandoned threshold.
• MV3 with no CSP; dom_sink_innerhtml_userctrl triggers elevated code quality risk (FIX B).

Evidence

• free_webmail_developer store Developer email christos7640@gmail.com — no business identity, no developer name listed.
• privacy_policy_not_extension_scoped api Policy fetched (313 chars) but scope_extension=false, data_collection=false — generic placeholder.
• suspicious_policy_host api Privacy policy hosted on resourceful-rat.static.domains — low-credibility free hosting subdomain.
• dom_xss_sink_no_csp crx dom_sink_innerhtml_userctrl in main.js; csp_present=false amplifies risk per FIX B.
• maintenance_stale store Last updated January 2, 2025; 17 months since update — within 6-24mo band (+6.0).
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• low_install_count store Only 143 installs — very low adoption reduces blast radius but not developer accountability.
• js_external_host crx js_external_hosts includes reactjs.org — likely CDN link reference, single US host, low diversity.

Permissions Breakdown

• clipboardWrite medium Can write to clipboard; limited risk but could inject malicious content.
• storage low Local extension storage only; low direct risk.

Pillar Scores

Bookkeeping