Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Amazon Listing Score Checker [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail dev email + unverified publisher + brand impersonation of Amazon raises accountability concerns.
• Uninstall URL hijack redirects to 10xprofit.io/tools — monetization/tracking of uninstalls.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension.
• Geo-diversity: JS served from 5 countries (CN, FR, GB, IE, US) for a tiny 42-install extension.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, not amazon.com; confirmed_owner=false.
• uninstall_url_hijack manifest uninstall_url_hijack=true targeting https://10xprofit.io/tools — 3rd-party monetization redirect.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic, not extension-scoped.
• gmail_developer store Developer email 10xprofitio@gmail.com is free webmail; no verified publisher badge.
• host_geo_diversity crx JS hosts span 5 countries (CN, FR, GB, IE, US) for a 42-install shopping tool — unusual surface.
• no_csp manifest csp_present=false on MV3; external JS hosts app.10xprofit.io active — no script-src restriction.
• maintenance_stale store months_since_update=7; falls in 6-12mo band (+3.5 maintenance score).
• install_url_hijack manifest install_url_hijack=true but target is welcome.html (internal) — low severity, noted for completeness.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Amazon Listing Score Checker [divergent] + malext.io malicious_extension_sentry; score 5.24 -> 7.74 (+2.5 cap 2.5).

Permissions Breakdown

• activeTab low Activates only on user-invoked tab; limited scope.
• storage low Local data persistence only; no network exfil implied.
• scripting medium Can inject JS into Amazon pages; paired with host_permissions.
• *://*.amazon.com/* (and 19 Amazon TLDs) medium Broad read/write access to all Amazon storefronts; scoped to Amazon only.

Pillar Scores

Bookkeeping