Top Risks

• Abandoned (26 months) with 70 installs; high risk of future compromise or sale.
• Requests webRequest + broad host access (*://*/*) on all sites.
• Install URL hijack detected (redirects to 3rd party on install).
• Developer identity is opaque ('admin') with no verified publisher status.
• Small install base with high-tier permissions (tail attack surface).

Evidence

• Stale update store Last updated 26 months ago (August 2024).
• High perms, low installs api install_perm_anomaly.small_install_high_perm is true (70 installs).
• Install hijack crx install_url_hijack: true detected in manifest analysis.
• Broad host access manifest host_permissions includes http://*/* and https://*/*.
• WebRequest access manifest permissions includes webRequest with broad host scope.
• Unverified developer store verified_publisher: false, developer_name: 'admin'.
• Privacy policy api Policy scoped to extension but admits 3rd-party sharing, no retention.
• No code findings crx code_findings_raw empty, obfuscation_score 0.0.

Permissions Breakdown

• webRequest high Can observe all network traffic; HIGH impact with broad host access.
• storage low Local state only.
• http://*/* high Broad host access on insecure HTTP.
• https://*/* high Broad host access to all secure sites.
• *://*/* high Content script injection on every site visited.

Pillar Scores

Bookkeeping