Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Lionel Messi Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is a generic Google account page — unfetched, unscoped, no extension-specific disclosures.
• Free-webmail developer (gmail.com) with no verified business identity.
• manifest_source is html_fallback — actual permissions unknown, cannot rule out undisclosed capabilities.
• Privacy policy link fetched with SSLError; actual data handling practices unverifiable.

Evidence

• manifest_source_html_fallback store manifest_source=html_fallback; no CRX parsed — permissions, host_permissions, content_scripts all unknown.
• privacy_policy_fetch_failed api Privacy policy URL points to Google account policy; fetch failed SSLError; scope_extension=false, data_collection=false.
• free_webmail_developer store Developer email nermincandas@gmail.com — free webmail, no business domain, no verified publisher badge.
• low_install_count store 605 installs — small user base limits blast radius but also reduces accountability signals.
• no_code_scanned crx js_files_scanned=0, code_findings_raw empty, obfuscation_score=0.0 — code surface entirely opaque.
• no_bad_hosts_or_monetization api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; no geo-diversity concerns.
• recently_updated store months_since_update=2; maintenance pillar low risk.
• no_cve_findings api cve_findings_raw empty; CVE pillar score 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Lionel Messi Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 2.88 -> 5.38 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping