Top Risks

• Uninstall URL hijack redirects to 10xprofit.io/tools — classic monetization/tracking pattern.
• Privacy policy admits data collection + third-party sharing but is NOT scoped to this extension (+10 privacy).
• Developer email is free Gmail (10xprofitio@gmail.com) with no verified publisher badge; zero accountability.
• Brand impersonation: 'Amazon' in name/description, developer domain is gmail.com, confirmed_owner=false.
• JS contacts 10xprofit.io and app.10xprofit.io from content scripts on all Amazon pages; exfil surface.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://10xprofit.io/tools — 3rd-party redirect on uninstall.
• brand_impersonation store brand_mention.is_impersonation=true; dev domain is gmail.com, not amazon.com.
• privacy_policy_generic api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• free_webmail_developer store Developer email 10xprofitio@gmail.com; not verified publisher; no org backing.
• js_external_hosts crx Extension loads/contacts 10xprofit.io and app.10xprofit.io from within Amazon page context.
• host_geo_diversity api JS hosts span 4 countries (FR, GB, IE, US); category not VPN/Adblock/Translation → +1.5 network.
• install_count_very_low store Only 6 installs; 5-star rating with no visible rating count — unverifiable social proof.
• months_since_update_3_to_6 store Last updated January 2026, ~7 months ago → maintenance +3.5.

Permissions Breakdown

• storage low Local key-value storage only; no cross-site or data-exfil risk on its own.
• *://*.amazon.com/* (and 19 regional Amazon domains) medium Content scripts run on all Amazon storefronts; scoped to one brand but very broad page access.

Pillar Scores

Bookkeeping