Top Risks

• Privacy policy URL returns connection error — effectively no accessible privacy policy.
• Uninstall URL hijack detected — extension registers uninstall redirect to 3rd party.
• Install URL hijack detected — extension opens external URL on installation.
• 23 months since last update — approaching zombie extension territory with no maintainer activity.
• Developer name absent; verified publisher but no public developer identity on listing.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Registers uninstall redirect; classic monetization/tracking pattern.
• install_url_hijack crx install_url_hijack=true; target=null. Opens external URL on install — low-effort traffic signal.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; reason=fetch_error:ConnectionError. Policy URL unreachable.
• stale_extension store months_since_update=23; last updated September 2024. High maintenance risk.
• verified_publisher store verified_publisher=true; partially mitigates reputation risk.
• no_developer_name store developer_name is empty string; reduces accountability.
• install_count_low store 458 installs; limited blast radius but uninstall/install hijacks still active.
• empty_manifest_with_installs_v3.5B crx permissions=[], host_permissions=[], content_scripts=[]; obfuscation=0; no code findings; 458 installs. +1.5 applied.

Pillar Scores

Bookkeeping