Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — NsLookup - Find DNS Records [browser-hijack] (+2.0, capped).
• Abandoned for 52 months (>36mo) — prime acquisition/compromise target for 3,000 installed users.
• Privacy policy is Google's generic account policy — does not scope to this extension, admits data collection and third-party sharing.
• Uninstall URL hijack flag present (uninstall_url_hijack=true) — potential post-removal tracking.
• Rating of 1.3 signals poor user trust; no developer name listed reduces accountability.

Evidence

• extreme_staleness store Last updated April 2022; 52 months since update — maintenance pillar maxed at 10.0.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag set — post-uninstall tracking risk.
• search_provider_override manifest chrome_settings_overrides.search_provider registers nslookup.io as a search engine; v2(a) scores this.
• no_developer_name store developer_name is empty string; reduces accountability; contributes to reputation score.
• low_rating store Rating 1.3 — very low user satisfaction signal.
• description_promise_mismatch store description_promise mismatch: promises recording but lacks tabCapture/desktopCapture permission.
• cve_clean crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — NsLookup - Find DNS Records [browser-hijack]; score 4.36 -> 6.36 (+2.0 cap 2.5).

Permissions Breakdown

• activeTab low Grants access to active tab on user gesture only; limited scope.
• chrome_settings_overrides.search_provider medium Registers a custom search provider; not set as default but modifies browser search settings.

Pillar Scores

Bookkeeping