Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — İSGPratik Bot [click-fraud] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• No developer name listed; reduces accountability.
• localhost:3000 host permission is a development artifact left in production manifest.
• No content_security_policy declared (MV3 default applies, but absence still noted).

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension. data_collection=true, third_party_sharing=true.
• verified_publisher store Extension carries verified publisher badge; developer domain isgpratik.com resolves and is not throwaway.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• localhost_host_permission manifest http://localhost:3000/* listed in host_permissions — likely dev artifact, not needed in production.
• narrow_host_scope manifest All non-localhost host permissions scoped to isgpratik.com/isgpratik.com.tr and Turkish gov portal csgb.gov.tr.
• no_code_findings crx code_findings_raw empty, obfuscation_score 0.0; single JS file scanned with no suspicious patterns.
• no_cve_findings crx cve_findings_raw empty; no vulnerable libraries detected.
• low_install_count store Only 262 installs; limited blast radius. No operator siblings, no bad-host or monetization hits.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — İSGPratik Bot [click-fraud] + malext.io malicious_extension_sentry; score 2.24 -> 4.74 (+2.5 cap 2.5).

Permissions Breakdown

• scripting medium Can inject scripts into pages matching host_permissions; scoped to dev-controlled and gov domains.
• downloads medium Can trigger file downloads; limited blast radius given narrow host scope.
• https://isgkatip.csgb.gov.tr/* medium Turkish government occupational safety portal — narrow, stated purpose.
• https://isgpratik.com/* low Developer's own domain; consistent with stated function.
• https://www.isgpratik.com/* low Developer's own domain (www variant).
• https://isgpratik.com.tr/* low Developer's own .tr domain variant.
• https://www.isgpratik.com.tr/* low Developer's own .tr domain (www variant).
• https://*.isgpratik.com.tr/* low Wildcard subdomain on developer-controlled domain only.
• http://localhost:3000/* low Localhost dev endpoint; no internet-facing risk, but suggests dev artifact left in production.

Pillar Scores

Bookkeeping