Top Risks

• <all_urls> host permission exceeds stated Reddit-companion scope; content_scripts narrow to reddit.com
• Small install base (453) combined with high-tier permissions creates tail-risk profile
• Brand impersonation signal: 'Reddit' in title without confirmed ownership
• External JS hosts include pay.oinkandstuff.com and pay.wwevents.fun monetization endpoints
• Install URL hijack opens chrome://settings/system on install

Evidence

• host_permissions crx <all_urls> declared but content_scripts limited to reddit.com; scope mismatch +1.0
• verified_publisher store Verified publisher AND featured by Google; both discounts applied, floor 2.0
• brand_mention store Reddit brand in title, not confirmed owner; +1.0 reputation (verified)
• js_external_hosts crx 12 distinct hosts incl pay.oinkandstuff.com, pay.wwevents.fun; geo-diversity 4 countries
• install_perm_anomaly store 453 installs + high-tier permissions = small_install_high_perm true; +1.5 webstore
• install_url_hijack crx onInstalled opens chrome://settings/system; +2.0 webstore
• privacy_policy api Scoped policy with collection/purpose/retention disclosed; adequate
• code_findings_raw crx innerHTML sink in mootools-core.js; CSP present, no CVEs, no eval; +0.5 only

Permissions Breakdown

• system.display low Display system info; minimal risk surface
• scripting medium Programmatic script injection capability
• activeTab low Temporary access to active tab only
• notifications medium Notifications combined with broad host access
• contextMenus low Context menu integration; low risk
• unlimitedStorage low Expanded local storage quota
• storage low Local data storage; standard
• <all_urls> high Broad host access to all websites; exceeds stated Reddit-only scope
• *://*.reddit.com/* medium Reddit host access; matches stated function
• *://*.wwevents.fun/* medium Dev domain host access; enables data exfil to operator

Pillar Scores

Bookkeeping