Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Amazon Sticky Notes [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Brand impersonation: developer (gmail) is not Amazon, confirmed non-owner, extension uses Amazon branding.
• Privacy policy admits data collection + third-party sharing with no extension-specific scope — worst-case policy.
• Uninstall and install URL hijack flags set; onInstalled/onUninstalled open 3rd-party URLs.
• Free-webmail dev (gmail) with no verified business identity; no verified publisher badge.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, confirmed_owner=false; extension named after Amazon.
• install_url_hijack + uninstall_url_hijack crx Both install_url_hijack and uninstall_url_hijack are true; targets null but hooks registered.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D-rule +10.0.
• free_webmail_developer store Developer email 10xprofitio@gmail.com; no verified publisher; no recognized org.
• content_scripts_broad_amazon manifest Content scripts injected into 23 Amazon TLDs (*://*.amazon.*/*).
• js_external_hosts crx Extension contacts 10xprofit.io and www.amazon.com externally; MV3 + no CSP.
• very_low_installs store Only 6 installs; high-capability extension with near-zero user base raises tail-risk.
• no_cve_no_obfuscation crx cve_findings_raw empty; obfuscation_score=0.0; code_findings_raw empty — code surface looks clean.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Amazon Sticky Notes [divergent] + malext.io malicious_extension_sentry; score 4.74 -> 7.24 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Used to persist sticky notes locally; low risk on its own.
• content_scripts (*://*.amazon.*/) medium Injects JS into all Amazon storefronts globally; can read page content and user data on those pages.

Pillar Scores

Bookkeeping