Top Risks

• Uninstall URL hijack and install URL hijack both present — classic monetization/redirect shell pattern.
• Free-webmail dev email (gmail) with no developer name and no verified publisher status.
• Privacy policy not scoped to this extension despite admitting data collection and third-party sharing — scores maximum privacy risk.
• Extension stale 29 months with extremely low installs (433) — zombie-shell risk profile.
• Privacy policy on drivemad.org unrelated to extension scope; generic site policy covering unknown data flows.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() triggers 3rd-party redirect on uninstall — classic monetization shell indicator.
• install_url_hijack crx onInstalled opens 3rd-party URL — used for affiliate/ad landing page traffic.
• free_webmail_no_dev_name store Developer email drivemadorg@gmail.com; no developer name listed; no verified publisher badge.
• privacy_policy_not_extension_scoped api Policy fetched but scope_extension=false while data_collection=true and third_party_sharing=true — worst-case privacy signal.
• maintenance_stale store Last updated March 14, 2024 — 29 months since update; 433 installs; abandoned zombie pattern.
• no_permissions_but_url_hijacks crx Zero declared permissions yet both install and uninstall URL hijacks present — minimal surface with monetization hooks.
• js_external_hosts crx External JS hosts: chrome.google.com, drivemad.org. drivemad.org is developer's own domain used for redirect/tracking.
• no_csp crx content_security_policy is null; csp_present=false — no script execution controls in place.

Pillar Scores

Bookkeeping