Top Risks

• Default search engine hijacked to g-maps.com via chrome_settings_overrides — classic monetization shell.
• Uninstall and install URL hijack both active; traffic capture on install and removal events.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• Developer domain dy1.com flagged as throwaway-looking; low-install (4) high-capability extension.
• Extension contacts external host g-maps.com with no CSP; policy is on same domain as search redirect.

Evidence

• search_provider_override manifest chrome_settings_overrides sets g-maps.com as default search engine with is_default=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; captures user traffic on removal.
• install_url_hijack crx install_url_hijack=true; opens third-party page on install.
• throwaway_domain api threat_intel.developer_domain_info.looks_throwaway=true for dy1.com.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false; data_collection=true, third_party_sharing=true — D rule applies.
• external_js_host crx js_external_hosts=[g-maps.com]; same domain as search redirect target.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension.
• very_low_installs store Only 4 installs; near-zero user base suggests early-stage or test deployment.

Permissions Breakdown

• storage low Stores local extension data; minimal standalone risk.
• chrome_settings_overrides.search_provider (is_default=true) high Hijacks default search engine to g-maps.com; primary monetization vector.

Pillar Scores

Bookkeeping