Top Risks

• Brand impersonation: mentions Netflix without being a Netflix-affiliated publisher; dev email is free Gmail.
• Install URL hijack detected (install_url_hijack=true); extension opens third-party URL on install.
• Free-webmail Gmail dev address with no verified business identity raises accountability concerns.
• Privacy policy admits data collection and third-party sharing; scoped to extension but retention-lite.
• No CSP (MV3 default) and contact to streamingextensions.com domain with unverified registrant.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; Netflix named in title; developer is not a confirmed Netflix owner.
• install_url_hijack crx install_url_hijack=true; opens third-party URL on install — monetization/tracking risk.
• free_webmail_developer store Developer email primepartyapp@gmail.com is free Gmail; no verified publisher badge.
• privacy_policy_third_party_sharing api Privacy policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true.
• no_csp crx content_security_policy=null; MV3 provides default but no explicit hardening applied.
• js_external_hosts crx Extension contacts streamingextensions.com and www.netflix.com; dev domain identity unverified.
• host_permissions_scope manifest 20 streaming host permissions incl. broad apple.com; justified for sleep-timer but wide surface.
• no_bad_hosts_or_cves api cve_findings_raw=[], bad_host_hits=[], code_findings_raw=[] — no malicious signals detected.

Permissions Breakdown

• storage low Stores timer settings locally; expected for this extension type.
• alarms low Schedules sleep-timer events; core to stated function.
• notifications low Shows sleep-timer alerts; expected and benign.
• *://*.netflix.com/* medium Content-script access to Netflix pages; matches stated function but can read page content.
• *://*.primevideo.com/* medium Content-script access; matches streaming-timer purpose.
• *://*.amazon.com/* (and regional variants) medium Broad Amazon host access incl. shopping pages beyond streaming; slight scope creep.
• *://*.disneyplus.com/* medium Streaming platform; matches stated function.
• *://*.youtube.com/* medium High-value platform; justified by sleep-timer use case.
• *://*.apple.com/* medium Broad apple.com covers more than Apple TV+; minor scope mismatch.

Pillar Scores

Bookkeeping