Top Risks

• GitLab brand impersonation by free-webmail Gmail developer with no verified identity.
• Google generic privacy policy — scope_extension=false, data_collection=true, third_party_sharing=true: policy admits broad sharing unrelated to this extension.
• Content script on <all_urls> with innerHTML DOM-XSS sinks and new Function() constructors; no CSP.
• Extension stale 25 months; triple-stale fingerprint (>24mo + MV3 but no CSP + functional code risks).
• bit.ly affiliate/cloaking hit in external JS hosts; 3 geo-diverse host countries (IN, SG, US).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'gitlab'; developer is gmail user tavy.andy97, not confirmed GitLab owner.
• generic_privacy_policy api Policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true => +10.0 privacy.
• dom_xss_and_function_constructor crx innerHTML sinks in content.js & popup.js; new Function() in event.js & popup.js; no CSP => code_quality elevated.
• stale_extension store Last updated May 2024, 25 months ago => maintenance +8.5; triple-stale Webstore +2.0.
• affiliate_hit_bitly crx bit.ly in js_external_hosts; affiliate_hits confirms generic short-link/cloaking redirector.
• broad_host_permissions manifest host_permissions=[<all_urls>] + content_scripts_matches=[<all_urls>] — full site read/write on every URL.
• free_webmail_developer store Developer email tavy.andy97@gmail.com; no business domain; developer_domain_info=null.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; 5000 installs + high-tier permissions = supply-chain risk.

Permissions Breakdown

• <all_urls> (host_permissions) high Grants content script access to every URL the user visits — full page read/write.
• <all_urls> (content_scripts_matches) high Content script injected on all URLs; combined with innerHTML sinks raises XSS risk.

Pillar Scores

Bookkeeping