Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — GoingMed [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy fetched but only 51 chars, not scoped to this extension — effectively no policy.
• Extension contacts multiple sci-hub domains (sci-hub.do/ee/ren/ru/se/st) — legally and reputationally sensitive.
• Bundled jQuery 1.8 with dynamic script injection and Function constructor; no CSP to mitigate.
• No developer name listed; privacy policy hosted on subdomain bm-com.com, not primary dev domain goingpub.com.

Evidence

• sci-hub_contacts crx js_external_hosts includes 6 sci-hub mirrors (sci-hub.do/ee/ren/ru/se/st) — copyright-bypass service, enterprise risk.
• privacy_policy_trivial api Policy URL fetched but length=51 chars, scope_extension=false, data_collection=false — not a real policy.
• no_csp manifest content_security_policy is null (MV3 default strict, but no explicit CSP set; dynamic script src in bundled jQuery 1.8).
• jquery_1.8_bundled crx jquery.min.1.8.js bundled — version released ~2012, well past EOL; Function() constructor and dynamic script src present.
• geo_diversity crx JS hosts span 4 countries: BZ, CA, CN, US — unusual distribution for an academic citation tool.
• no_developer_name store developer_name is empty string; verified_publisher badge present but no public-facing org name.
• privacy_policy_domain_mismatch store Privacy policy on plug2025.bm-com.com, not goingpub.com (dev domain); bm-com.com is a separate entity.
• verified_publisher store verified_publisher=true; goingpub.com resolves and not throwaway — partial reputation credit.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — GoingMed [data-theft] + malext.io malicious_extension_sentry; score 2.59 -> 5.09 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local preferences; no data exfil risk on its own.
• content_scripts(*://*.semanticscholar.org/*,...) medium Script injection on 5 academic/research domains; limited scope but code runs in page context.

Pillar Scores

Bookkeeping