Top Risks

• Search-provider override hijacks all browser searches to nautilus-notes.com — primary monetization vector.
• Developer uses free Outlook email with no verified publisher status; low accountability.
• Extension is 19 months stale with no JS observable (zero-surface CRX) making future changes unauditable.
• 50K installs with zero ratings is anomalous and may indicate artificial distribution.
• Privacy policy scoped and complete, but extension sole function is search redirection to dev-owned domain.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider sets is_default:true, routing all searches to https://nautilus-notes.com/search
• free_webmail_developer store Developer email nautilusnotes@outlook.com is a free-webmail account; no verified publisher badge.
• stale_extension store Last updated January 31 2025; 19 months since update exceeds 18-month stale threshold.
• zero_js_surface crx js_file_count=0, code_findings_raw empty, obfuscation_score=0. Extension is manifest-only; no auditable JS.
• anomalous_install_rating store 50,000 installs with rating=0 and rating_count=0; unusual distribution pattern.
• privacy_policy_adequate api Policy at nautilus-notes.com/privacy.php fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• no_threat_intel_hits api bad_host_hits, monetization_hits, affiliate_hits all empty; no known-bad infrastructure detected.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable JS libraries detected.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default:true) medium Replaces default search engine; redirects all searches to nautilus-notes.com. Core monetization surface.

Pillar Scores

Bookkeeping