Top Risks

• Abandoned extension: 52 months since last update, no maintenance oversight.
• Privacy policy is Google's generic policy, does not scope to this extension; admitted data collection + 3rd-party sharing without extension context → +10.0.
• Developer uses free-webmail Gmail address with no verified business identity.
• No CSP present; content scripts inject into OpenSea and LooksRare with external host (ranknft.online).
• Developer domain (metarankings.io) cannot be verified; domain_age_ct not queried due to free webmail.

Evidence

• maintenance_stale store Last updated February 2, 2022; 52 months ago — zombie extension.
• privacy_policy_generic store Policy URL is Google account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_email_free_webmail store upcomingnftlive@gmail.com — free webmail, no verified business; developer_domain=gmail.com.
• no_csp crx content_security_policy is null; MV3 mitigates remote eval but no CSP increases injection surface.
• external_hosts crx Extension contacts ranknft.online and twitter.com; ranknft.online is operator-controlled but unverifiable.
• no_permissions manifest permissions[] and host_permissions[] empty; content_scripts scoped to looksrare.org and opensea.io only.
• cve_findings_empty crx No CVEs found. jquery 3.6.0 bundled; no known CVEs at this version per cve_findings_raw.
• reputation_no_verified_publisher store verified_publisher=false, is_featured_by_google=false; developer identity unverifiable.

Permissions Breakdown

• content_scripts: https://looksrare.org/* low Scoped to NFT marketplace; matches stated function of rarity rankings.
• content_scripts: https://opensea.io/* low Scoped to NFT marketplace; matches stated function of rarity rankings.

Pillar Scores

Bookkeeping