Top Risks

• Abandoned: 46 months since last update raises supply-chain takeover risk.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer email is free webmail (gmail); no verified business domain.
• No CSP declared (MV3 strict default mitigates, but adds minor concern).
• Low install base with stale code reduces community oversight.

Evidence

• maintenance_stale store Last updated August 21 2022; 46 months since update — zombie tier (+10.0 maintenance).
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• developer_free_webmail store dev email djbielejeski@gmail.com; company name present but no verified domain; reputation penalty applied.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount.
• narrow_host_permission manifest Only host_permissions: https://poloniex.com/* — single exchange API, matches stated function.
• no_code_findings crx code_findings_raw empty; obfuscation_score 0.0; no malicious indicators detected.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; single JS host poloniex.com (IN).

Permissions Breakdown

• https://poloniex.com/* low Narrow host permission scoped to single exchange API; matches stated ETH price function.

Pillar Scores

Bookkeeping