Top Risks

• Amazon brand impersonation by gmail developer with no verified ownership — confirmed by brand_mention.is_impersonation.
• Privacy policy is Google's own policy (scope_extension=false, data_collection+third_party_sharing=true) — scores maximum privacy risk.
• Uninstall URL hijack to third-party Google Form; classic webstore monetization/tracking signal.
• Localhost host permissions (3000, 8000) allow probing local services — unjustified for a video downloader.
• Dynamic script creation + multiple new Function() calls in popup and offscreen code raises code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands=['amazon'], confirmed_owner=false, dev email gmail.com.
• privacy_policy_generic_google crx Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection+third_party_sharing=true.
• uninstall_url_hijack crx setUninstallURL -> docs.google.com/forms/... (third-party feedback/tracking redirect).
• localhost_host_permissions manifest http://localhost:3000/*, http://localhost:8000/*, http://127.0.0.1:8000/* — can probe local dev services.
• dynamic_script_loading crx script_src_dynamic in popup-new.js; webpack runtime creates <script> elements dynamically.
• function_constructor_multiple_files crx new Function() found in popup-new.js, jszip.min.js, offscreen.js — code execution surface.
• free_webmail_developer store Developer email rukeypei@gmail.com; no business domain; not verified publisher.
• is_featured_by_google store Extension carries Google Featured badge; partial trust signal offsetting reputation slightly.

Permissions Breakdown

• activeTab low Scoped to user-activated tab only; minimal surface.
• tabs medium Can read tab URLs/titles across all tabs.
• storage low Local data persistence; low standalone risk.
• downloads medium Can initiate arbitrary file downloads to user's disk.
• offscreen low Runs offscreen document; used here for media processing.
• host:https://amz-download-video.imvbird.com/* medium Unknown third-party domain; potential data exfil endpoint.
• host:https://*.amazonaws.com/* medium Broad AWS CDN access; consistent with video download use case.
• host:https://*.cloudfront.net/* medium Amazon CDN; functionally justified for video downloader.
• host:https://*.akamaized.net/* + akamaihd.net/* medium Akamai CDN; consistent with Amazon streaming infrastructure.
• host:http://localhost:3000/* + localhost:8000/* + 127.0.0.1:8000/* high Localhost access can probe local services; unusual for a video downloader.

Pillar Scores

Scoring History

Bookkeeping