Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Paper.io Original [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns connection error — effectively no accessible privacy policy.
• Uninstall URL hijack detected — extension registers uninstall redirect to 3rd party.
• Install URL hijack detected — extension opens external URL on installation.
• 23 months since last update — approaching zombie extension territory with no maintainer activity.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Registers uninstall redirect; classic monetization/tracking pattern.
• install_url_hijack crx install_url_hijack=true; target=null. Opens external URL on install — low-effort traffic signal.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; reason=fetch_error:ConnectionError. Policy URL unreachable.
• stale_extension store months_since_update=23; last updated September 2024. High maintenance risk.
• verified_publisher store verified_publisher=true; partially mitigates reputation risk.
• no_developer_name store developer_name is empty string; reduces accountability.
• install_count_low store 458 installs; limited blast radius but uninstall/install hijacks still active.
• empty_manifest_with_installs_v3.5B crx permissions=[], host_permissions=[], content_scripts=[]; obfuscation=0; no code findings; 458 installs. +1.5 applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Paper.io Original [adware] [divergent] + malext.io malicious_extension_sentry; score 4.27 -> 6.77 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping