Top Risks

• Privacy policy is Google's generic policy (not scoped to this extension) yet admits data collection and third-party sharing — score 10.0.
• Extension stale 27 months with no update; potential abandonment risk.
• Brand impersonation: uses Amazon™ trademark, developer is unverified gmail user.
• Free-webmail developer (gmail) with no business website or verified publisher badge.
• Content scripts injected into all Amazon domains globally, providing DOM access at every session.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; uses Amazon™ trademark; developer is gmail user with no verified ownership.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• stale_extension store last_updated March 2024; months_since_update=27 → maintenance +8.5.
• free_webmail_developer store Developer email ggehrke58@gmail.com; no business domain; no verified publisher badge.
• content_scripts_amazon manifest Content scripts injected on 21 amazon.* TLD patterns; matches stated function but grants broad DOM access.
• no_csp manifest csp_present=false; MV3 strict default applies, no additional network penalty applied.
• no_code_findings crx 0 JS files scanned, obfuscation_score=0.0, code_findings_raw empty; code quality risk minimal.
• no_bad_hosts api threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty; operator_cluster sibling_count=0.

Permissions Breakdown

• content_scripts on https://*.amazon.*/ medium Runs JS on all Amazon domains globally; scoped to stated function but grants DOM access.

Pillar Scores

Bookkeeping