Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Remilia Scarlet Touhou Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to haberikra.com — classic monetization shell redirecting departing users to 3rd-party site.
• Install URL hijack to gameograf.com — opens 3rd-party page on install, consistent with traffic arbitrage pattern.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override with 9 external JS hosts (YouTube, Netflix, Instagram, X, ChatGPT, etc.) — broad reach for a wallpaper.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> haberikra.com with UTM params; textbook monetization shell signal.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; install-time traffic capture.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab replaced by this wallpaper extension.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts_breadth crx 9 distinct external hosts in JS including chatgpt.com, netflix.com, instagram.com — excessive for a wallpaper.
• verified_publisher_stale store Verified publisher but months_since_update=21 >18; discount capped at -1.0 per invariant 0c.
• no_developer_name store developer_name is empty string; Reputation pillar +1.0 for missing 'Offered by' display name.
• maintenance_stale store 21 months since last update; falls in 12-24mo band (+6.0 Maintenance pillar).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Remilia Scarlet Touhou Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.46 -> 6.96 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with newtab override increases monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; primary vector for traffic monetization and search hijacking.

Pillar Scores

Bookkeeping