Top Risks

• Gmail dev email with brand impersonation of 'YouTube'; unverified personal developer identity.
• Privacy policy admits data collection and third-party sharing but lacks retention disclosure.
• Extension contacts AWS Lambda endpoint (olpxmd7ib2.execute-api.us-east-1.amazonaws.com) of unknown purpose.
• new Function() constructor present in content script injected on YouTube — dynamic code execution risk.
• Uninstall URL hijack flag set; post-removal tracking possible.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions 'youtube' but developer is personal Gmail account, not YouTube/Google.
• gmail_dev_email store Developer email alik0211alik@gmail.com; free webmail, no business domain verified.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discount applies but capped due to monetization hit.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets uninstall URL to track post-removal.
• external_aws_endpoint crx js_external_hosts includes olpxmd7ib2.execute-api.us-east-1.amazonaws.com — purpose unknown.
• function_constructor crx new Function() in content.js; Vue.js internals pattern but allows dynamic code execution.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• monetization_hit_telemetry api google-analytics.com in monetization_hits; telemetry tier only, single hit.

Permissions Breakdown

• alarms low Scheduled tasks only; low standalone risk.
• storage low Local extension data storage; no cross-origin risk.
• host: https://www.youtube.com/* medium Content-script injection on YouTube; scoped but reads page content and DOM.

Pillar Scores

Bookkeeping