Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Goalkeeper Challenge [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy hosted on CDN domain (cloudapi.stream), not scoped to this extension; admits third-party sharing.
• Uninstall and install URL hijack flags set — onInstalled opens popup/index.html and uninstall hook present.
• jQuery 3.2.1 bundled with 3 moderate CVEs (XSS); sandbox CSP allows unsafe-eval/unsafe-inline amplifying risk.
• Developer uses free Gmail address; no verified publisher badge; privacy policy not on dev-controlled domain.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both flags true; install opens popup/index.html internally; uninstall hook present with null target.
• privacy_policy_scope_mismatch crx Policy fetched from cdn.cloudapi.stream; scope_extension=false, data_collection=false, third_party_sharing=true.
• jquery_cve_bundle crx jquery@3.2.1 has 3 moderate CVEs: CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; fixed in 3.5.0.
• sandbox_csp_unsafe_eval manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src, elevating XSS risk from jQuery CVEs.
• free_webmail_developer store Developer email nadejdinv@gmail.com; no verified publisher; no business website confirmed.
• external_js_hosts crx 11 external JS host references including goo.gl, codecanyon.net, bnjmnt4n.now.sh, createjs.com.
• low_install_count store Only 177 installs; tail-attack-surface anomaly not flagged but very small reach limits blast radius.
• no_permissions_declared manifest permissions[], host_permissions[], content_scripts_matches[] all empty — minimal declared capability.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Goalkeeper Challenge [credential-theft] + malext.io malicious_extension_sentry; score 2.87 -> 5.37 (+2.5 cap 2.5).

CVE Exposures (3)

Pillar Scores

Bookkeeping