Top Risks

• Abandoned: last updated July 2022, 47 months ago — no security patches in nearly 4 years.
• Privacy policy is Google's generic account policy; not scoped to this extension at all.
• Free-webmail developer (gmail) with no verified business identity; brand mentions GitHub without ownership.
• innerHTML sink in main.js introduces DOM-XSS risk; no CSP to mitigate.
• External JS host (www.onlinewebfonts.com) loaded from a non-dev-controlled CDN.

Evidence

• abandoned_extension store Last updated July 14, 2022; 47 months stale — no maintenance for nearly 4 years.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, third_party_sharing=true — not scoped to this extension.
• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer is gmail user with no verified owner status.
• dom_xss_sink crx main.js: innerHTML assigned from variable with no CSP present — DOM-XSS risk.
• external_js_host crx js_external_hosts includes www.onlinewebfonts.com — third-party asset host outside dev control.
• no_csp manifest content_security_policy is null; MV3 provides some default protection but no explicit CSP declared.
• free_webmail_dev store Developer email nlustiger@gmail.com; no business domain, no verified publisher badge.
• featured_by_google store is_featured_by_google=true — partial reputation signal, but does not override staleness and privacy gaps.

Permissions Breakdown

• scripting medium Allows JS injection into pages; scoped only to github.com via host_permissions.
• *://github.com/* low Narrow host scope limited to github.com; matches stated function.

Pillar Scores

Bookkeeping