Top Risks

• Default search engine hijacked to oneglobalsearch.com; dev email is numbered-alias Gmail — strong monetization-shell fingerprint.
• Privacy policy URL dead (fetch error); policy unverifiable — treated as no policy (+10).
• Extension stale 26 months with only 3 installs; zombie/sleeper risk.
• Uninstall URL hijack redirects to 3rd-party goodbye page; install URL hijack opens welcome page.
• No developer name, free-webmail numbered alias, verified_publisher flag provides minimal trust here given staleness.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true pointing to oneglobalsearch.com — replaces user default search.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://oneglobalsearch.com/goodbye.html (3rd-party redirect on uninstall).
• install_url_hijack crx onInstalled opens https://oneglobalsearch.com/welcome.html — unsolicited 3rd-party page on install.
• privacy_policy_fetch_error api Privacy policy URL returned ConnectionError; policy unverifiable — scored as no policy.
• numbered_alias_dev_email store developer_email=media.ads.2021@gmail.com — numbered alias free-webmail, no verified business identity.
• stale_extension store 26 months since last update with only 3 installs; maintenance pillar 8.5.
• no_developer_name store developer_name is empty string; no accountable identity beyond Gmail alias.
• verified_publisher_cap store verified_publisher=true but months_since_update=26 >18mo triggers v3.5 invariant 0c; discount capped at -1.0.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Silently replaces user's default search engine with oneglobalsearch.com.

Pillar Scores

Bookkeeping