Top Risks

• Default search engine override routes all queries to dev-controlled audiosearchpro.com — core monetization mechanism.
• Developer email is numbered-alias Gmail (a23423224@) with no developer name — throwaway-account pattern.
• Uninstall URL hijack detected — extension registers a 3rd-party URL on removal.
• Category/permission mismatch: audio search description but search provider override suggests traffic-monetization intent.
• Low install count (1,000) + free webmail dev with no verified identity raises tail-attack-surface concern.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, redirecting all browser searches to audiosearchpro.com/search.php
• numbered_alias_email store Developer email a23423224@gmail.com matches numbered-alias pattern; no developer name listed.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers callback on uninstall to external URL.
• search_override_medium_reputation store Not verified publisher, not featured, free-webmail dev — no accountability for search override.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — fully disclosed.
• js_external_hosts crx 9 external JS hosts including soundcloud.com, archive.org, pixabay.com — broad but audio-content-consistent.
• no_code_findings crx obfuscation_score=0.0, code_findings_raw empty, 2 JS files scanned — no malicious code signals.
• maintenance store 10 months since update — 3-6mo bracket; moderate staleness.

Permissions Breakdown

• host_permissions: https://audiosearchpro.com/* low Narrow host permission to dev's own domain only.
• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine to dev-controlled endpoint; classic monetization vector.

Pillar Scores

Bookkeeping