Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Altitude Wallet [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — earns maximum privacy score.
• Broad host access (<all_urls> + content scripts on all sites) with only 8 installs creates a disproportionate attack surface.
• No developer name listed; anonymous publisher increases accountability risk.
• 9 external JS hosts including Vercel blob storage — uncommon for a wallet; supply-chain risk if any host is compromised.

Evidence

• host_permissions_all_urls manifest <all_urls> host permission + content_scripts on <all_urls>: extension runs on every site user visits.
• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to extension.
• no_developer_name store developer_name field is empty; no 'Offered by' identity visible.
• external_js_hosts crx 9 external hosts including vercel-storage blob CDN and localhost; supply-chain exposure.
• install_perm_anomaly api Only 8 installs with high-tier host permission — small_install_high_perm=true.
• no_csp manifest csp_present=false on MV3; default MV3 CSP applies but no explicit extension policy declared.
• verified_publisher_false store Not a verified publisher, not featured by Google; no trust signals.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, no CVEs, no bad-host hits.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Altitude Wallet [credential-theft] + malext.io malicious_extension_sentry; score 2.92 -> 5.42 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local wallet data; expected for a wallet extension.
• sidePanel low Opens sidebar UI; low direct risk.
• <all_urls> (host_permissions) high Grants content script access to every page; can read/modify all web content.
• <all_urls> (content_scripts_matches) high Injects JS on every site; broad reach for a crypto wallet.

Pillar Scores

Bookkeeping