Top Risks

• Free-webmail dev (gmail), no developer name, no verified publisher — anonymous operator with opaque accountability.
• Uninstall and install URL hijack flags set — lifecycle event hooking is a monetization/tracking pattern.
• Privacy policy hosted on CDN (cloudapi.stream), not scoped to this extension, admits third-party sharing without specifics.
• Three medium-severity jQuery CVEs (3.1.1) bundled well below fixed version 3.5.0 — XSS surface inside extension sandbox.
• Sandbox CSP allows unsafe-eval and unsafe-inline — weakens extension-page isolation where jQuery CVEs exist.

Evidence

• anonymous_developer store No developer name set; email is nadejdinv@gmail.com (free webmail). Reputation floor triggers at 7.5.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag present — lifecycle event captured, monetization shape.
• install_url_hijack crx install_url_hijack=true targeting popup/index.html — onInstalled opens internal page, lightweight hijack pattern.
• jquery_cve_triple crx jquery@3.1.1 carries CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all moderate XSS); fixed in 3.5.0.
• sandbox_csp_unsafe crx Sandbox CSP allows unsafe-inline and unsafe-eval on script-src — weakens isolation where vulnerable jQuery runs.
• privacy_policy_not_scoped store Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true → +9.0 privacy.
• js_external_hosts_11 crx 11 external JS hosts referenced (bnjmnt4n.now.sh, cloudapi.stream, codecanyon.net, createjs.com etc.) — broad external surface.
• low_installs_entertainment store Only 248 installs for a game extension; rating count not meaningful. Limited blast radius but tail-attack surface.

CVE Exposures (3)

Pillar Scores

Bookkeeping