Top Risks

• Gmail dev email + unverified publisher + brand impersonation of Amazon raises accountability concerns.
• Uninstall URL hijack redirects to 10xprofit.io/tools — monetization/tracking of uninstalls.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension.
• Geo-diversity: JS served from 5 countries (CN, FR, GB, IE, US) for a tiny 42-install extension.
• No CSP on MV3 extension with external JS hosts (10xprofit.io, app.10xprofit.io) contacting scripted Amazon pages.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, not amazon.com; confirmed_owner=false.
• uninstall_url_hijack manifest uninstall_url_hijack=true targeting https://10xprofit.io/tools — 3rd-party monetization redirect.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic, not extension-scoped.
• gmail_developer store Developer email 10xprofitio@gmail.com is free webmail; no verified publisher badge.
• host_geo_diversity crx JS hosts span 5 countries (CN, FR, GB, IE, US) for a 42-install shopping tool — unusual surface.
• no_csp manifest csp_present=false on MV3; external JS hosts app.10xprofit.io active — no script-src restriction.
• maintenance_stale store months_since_update=7; falls in 6-12mo band (+3.5 maintenance score).
• install_url_hijack manifest install_url_hijack=true but target is welcome.html (internal) — low severity, noted for completeness.

Permissions Breakdown

• activeTab low Activates only on user-invoked tab; limited scope.
• storage low Local data persistence only; no network exfil implied.
• scripting medium Can inject JS into Amazon pages; paired with host_permissions.
• *://*.amazon.com/* (and 19 Amazon TLDs) medium Broad read/write access to all Amazon storefronts; scoped to Amazon only.

Pillar Scores

Bookkeeping