Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Amazon Character Count & Seller Tools [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy fetched but admits data collection and third-party sharing without scoping to this extension — worst-case disclosure.
• Brand impersonation: dev (gmail, no confirmed ownership) uses 'Amazon' branding without being Amazon.
• Free-webmail developer with no verified business identity; floor elevated to 7.5.
• Install-URL hijack opens third-party URL on install — low-trust onboarding signal.

Evidence

• privacy_policy_admits_third_party_sharing_no_scope api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy (v3.5 rule D).
• brand_impersonation store brand_mention.is_impersonation=true for 'amazon'; dev is gmail user, confirmed_owner=false → +2.0 Reputation.
• free_webmail_developer store ecomstal.official@gmail.com, no business website; Reputation floor applied at 7.5.
• install_url_hijack manifest install_url_hijack=true; extension opens third-party URL on install → +2.0 Webstore.
• broad_amazon_host_permissions manifest 23 Amazon TLD host_permissions + content_scripts; scoped to Amazon only, justified by stated function.
• cve_findings_empty crx No CVEs detected; CVE pillar = 0.0.
• code_findings_empty_obfuscation_zero crx code_findings_raw empty, obfuscation_score=0.0; Code Quality pillar = 0.0.
• no_csp_present_mv3 manifest csp_present=false; MV3 has strict default so no network penalty for missing CSP.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Amazon Character Count & Seller Tools [divergent] + malext.io malicious_extension_sentry; score 4.09 -> 6.59 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension preferences; low direct harm.
• activeTab low Access current tab on user gesture only; scoped and low-risk.
• *://*.amazon.com/* (and 21 other Amazon TLDs) medium Broad host access across all Amazon domains; content scripts run on every Amazon page.

Pillar Scores

Bookkeeping