Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

Rotate that Video Player

ijpcmpbcokpgmecfkmehleemljfkeimo
Risk Score
2.67
Risk Level: Low
Recommendation: 🟢 LOW RISK — review
Category Entertainment
Installs 80,000
Rating 3.7
Last updated 2026-01-27 (5 months ago)
Manifest version MV3
CSP present ✅ yes
Developer support@stefanvd.net
Verified publisher ✅ yes
Featured by Google ✅ yes
Privacy policy link
Web Store open ↗

Top Risks

  • install_url_hijack: onInstalled opens twitter/X intent URL — unsolicited 3rd-party navigation on install.
  • uninstall_url_hijack flag set (target null) — possible uninstall tracking or prior abuse.
  • Operator cluster sibling detected under same fingerprint; pattern may indicate templated extension farm.
  • Content scripts injected on all http/https URLs — broad page-level reach for a simple video rotator.
  • Rating 3.7 below 4.0 threshold; developer name absent from listing.

Evidence

  • install_url_hijack crx onInstalled opens https://x.com/intent/tweet?text= — unsolicited 3rd-party redirect on install.
  • uninstall_url_hijack crx uninstall_url_hijack=true but target is null; flag present, possible prior or partial tracking.
  • operator_cluster store sibling_count=1 (emiochiflnnegkecnjndifbobmbepdne) under same compound fingerprint.
  • content_scripts_broad manifest content_scripts_matches includes http://*/* and https://*/* — all-page injection.
  • verified_publisher + featured store Extension is verified publisher and featured by Google; reputation floor applied.
  • privacy_policy api Policy fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
  • no_bad_hosts_no_cves crx No bad_host_hits, no affiliate_hits, no monetization_hits, no CVEs detected.
  • csp_present_mv3 manifest CSP present, MV3; script-src 'self'; no unsafe-eval/inline on scripts.

Permissions Breakdown

  • activeTab low Grants access only to the currently active tab on user interaction.
  • scripting medium Allows injecting scripts into pages; scope limited by activeTab/content_scripts.
  • storage low Local key-value storage for extension settings; no exfiltration surface alone.
  • contextMenus low Adds right-click menu items; low standalone risk.
  • content_scripts http://*/* https://*/* medium Content scripts run on all pages; combined with scripting raises read surface.

Pillar Scores

Permissions2.30
Reputation2.00
Network2.00
Webstore5.50
Maintenance1.50
Privacy1.00
Code Quality0.00
CVE Exposure0.00

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

Bookkeeping

Rubric v3.6
Scored at 2026-06-16 07:43
Listing SHA db519150a1f9…
Force block — not fired
Score recovered no
Elapsed 21.9s