Top Risks

• Brand impersonation: extension uses 'Amazon' brand name with gmail dev, not a verified Amazon entity.
• Gmail developer with no verified business domain; accountability gap for 600K users.
• Privacy policy discloses third-party sharing but is hosted on personal HTTP domain without HTTPS.
• install_url_hijack flag set — onInstalled opens a URL, possible traffic redirect on install.
• No CSP defined (MV3 default mitigates but external host revseller.com is unexplained).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; confirmed_owner=false; developer_domain=gmail.com.
• install_url_hijack crx install_url_hijack=true; target null but onInstalled redirect pattern present.
• gmail_developer store Developer email fromamid@gmail.com; no verified business domain.
• external_host_revseller crx js_external_hosts includes www.revseller.com; not explained by Shopping category.
• privacy_third_party_sharing api Policy fetched, scoped, data_collection=true, third_party_sharing=true; retention disclosed.
• featured_by_google store is_featured_by_google=true; reduces reputation risk somewhat.
• no_cve_findings crx cve_findings_raw empty; jquery 3.6.0 bundled, no known CVEs at this version.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; 7/7 JS files scanned cleanly.

Permissions Breakdown

• storage low Stores local extension preferences; no cross-origin data risk.
• *://*.amazon.com/* medium Content-script host access on Amazon; scoped to stated function (shopping tool).
• *://*.amazon.co.uk/* medium Content-script host access on Amazon UK; scoped to stated function.

Pillar Scores

Scoring History

Bookkeeping