Top Risks

• Privacy policy URL not fetchable (connection error) — treated as no policy; extension contacts external host.
• Developer domain spiderdunia.com does not resolve, reducing accountability.
• Extension is 17 months stale (no update since Jan 2025); elevated maintenance risk.
• Developer identity is a handle (#beaubhavik) with no verifiable business presence.
• Low install count (385) limits blast radius but also limits third-party scrutiny.

Evidence

• privacy_policy_unfetchable api Privacy policy URL returned fetch_error:ConnectionError — scored as unavailable (+10.0 privacy pillar).
• developer_domain_not_resolving api threat_intel.developer_domain_info.resolves==false for spiderdunia.com; reduces accountability.
• maintenance_stale store Last updated January 28, 2025; 17 months since update → +6.0 maintenance pillar.
• narrow_host_permission manifest host_permissions scoped to *://api.ipify.org/* only; matches stated IP-monitoring function.
• no_code_findings crx code_findings_raw empty, obfuscation_score 0.0, no malicious JS patterns detected.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; no operator cluster siblings.
• mv3_csp_present manifest MV3 with strict CSP (script-src 'self'; object-src 'self'); no unsafe-eval/inline.

Permissions Breakdown

• notifications medium Can display notifications; low standalone risk, fits IP-monitoring use case.
• *://api.ipify.org/* low Narrow host permission to single IP-lookup API; matches stated function.

Pillar Scores

Bookkeeping