Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Fast Weather & Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all queries through fastweather.net redirect before Yahoo — monetization funnel.
• Install and uninstall URL hijacks enable affiliate/tracking telemetry on install lifecycle events.
• Privacy policy discloses third-party data sharing but lacks retention details; scope is extension-specific.
• Developer name blank; admin@clicksco.com is a commercial affiliate network with monetization history.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to fastweather.net/api/get-redirection proxy, intercepting all searches.
• install_url_hijack manifest onInstalled opens https://fastweather.net/thankyou?install=true — affiliate/tracking callback.
• uninstall_url_hijack manifest setUninstallURL points to https://fastweather.net/uninstall?uninstall=true — monetization signal.
• verified_publisher_capability_gate store Verified publisher but search_provider override is HIGH capability; v2 gate blocks full -3.0 discount.
• privacy_policy_third_party_sharing api Policy fetched, scoped to extension, data_collection=true, third_party_sharing=true, retention=false.
• developer_no_name store developer_name is empty string; no 'Offered by' visible — mild accountability gap.
• no_bad_hosts_no_cves crx threat_intel.bad_host_hits empty, cve_findings_raw empty, obfuscation_score=0.0.
• low_install_count store Only 158 installs — limited blast radius but search-override monetization model confirmed.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Fast Weather & Search [browser-hijack] + malext.io malicious_extension_sentry; score 2.38 -> 4.88 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Forces Yahoo via fastweather.net redirect as default search; intercepts all user searches.
• uninstall_url_hijack medium Sets uninstall callback to fastweather.net; tracks uninstall events for analytics/re-engagement.
• install_url_hijack medium Opens fastweather.net on install; data collection trigger, potential affiliate tracking.

Pillar Scores

Bookkeeping