Top Risks

• Brand impersonation: mentions Microsoft but developer is unaffiliated individual (ukhan.in.ua).
• Privacy policy (GitHub) does not scope to this extension, admits data collection and third-party sharing, no retention.
• Install URL hijack: onInstalled opens GitHub changelog URL (third-party redirect signal).
• Stale 19 months with no CSP; scripting+tabs permissions retain meaningful capability.
• function_constructor pattern in 3 JS files; though likely bundler artifact, raises code-quality concern.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions Microsoft; developer is Pavlo Ukhan at ukhan.in.ua, not Microsoft.
• privacy_policy_violation api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D clause: +10.0.
• install_url_hijack crx install_url_hijack=true; target=github.com changelog page; Webstore +2.0.
• no_csp manifest content_security_policy=null on MV3; no v2 +2.0 penalty but weaker runtime protection.
• function_constructor_x3 crx function_constructor signal in background.js, options.js, popup.js; +2.5 code quality.
• maintenance_stale store months_since_update=19; 12-24mo band → +6.0 maintenance.
• is_featured_by_google store Featured badge present; -2.0 reputation discount applied.
• network_hosts crx js_external_hosts: github.com, graph.microsoft.com, login.microsoftonline.com; 3 domains, all MS/GitHub.

Permissions Breakdown

• identity low OAuth token access for Microsoft login; scoped to stated function.
• contextMenus low Adds right-click menu item; low risk.
• storage low Local data persistence; standard low risk.
• notifications low Shows browser notifications; low risk.
• activeTab low Access only to current tab on user action; limited scope.
• tabs medium Can read tab URLs and titles across all tabs.
• scripting medium Can inject scripts into pages; elevated without broad host perms here.

Pillar Scores

Bookkeeping