Top Risks

• Uninstall URL hijack to saxsos.xyz — classic monetization/tracking shell pattern.
• Privacy policy admits data collection and third-party sharing without scoping to this extension (D rule: +10.0 privacy).
• Free-webmail developer (gmail) with no verified business domain; saxsos.xyz used as primary backend.
• JS external host saxsos.xyz contacts extension backend; policy on same domain is unscoped.
• Install URL hijack to welcome.html with external host suggests onboarding funnel to saxsos.xyz.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://www.saxsos.xyz/p/sorry.html (3rd-party domain).
• install_url_hijack crx onInstalled opens welcome.html; js_external_hosts includes www.saxsos.xyz.
• privacy_policy_unscoped_with_sharing store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — D rule triggers +10.0.
• free_webmail_developer store Developer email ecomstal.official@gmail.com; no verified business domain; reputation floor 7.5.
• js_external_host crx Extension loads/contacts www.saxsos.xyz — same domain as privacy policy and uninstall URL.
• no_csp crx content_security_policy is null / csp_present=false; MV3 mitigates but no explicit CSP declared.
• very_low_install_count store Only 5 installs; new/unproven extension with no ratings.
• host_geo_diversity api JS hosts span RU, SG, US (3 countries); below +1.5 threshold of 4.

Permissions Breakdown

• storage low Stores user preferences locally; low standalone risk.
• *://*.aliexpress.com/* medium Scoped host access to AliExpress; content scripts can read/modify page content.
• *://*.aliexpress.ru/* medium Same risk surface as aliexpress.com host permission.
• *://*.aliexpress.us/* medium Same risk surface as aliexpress.com host permission.
• *://*.aliexpress.bn/* medium Additional AliExpress TLD host permission.
• *://*.aliexpress.is/* medium Additional AliExpress TLD host permission.
• *://*.aliexpress.pk/* medium Additional AliExpress TLD host permission.

Pillar Scores

Bookkeeping