Top Risks

• Uninstall URL hijack AND install URL hijack both active — classic monetization/redirect shell pattern.
• Privacy policy is Google's own policy (not extension-scoped), admits data collection and 3rd-party sharing — scores maximum privacy risk.
• Free-webmail Gmail developer with no verified identity or business website.
• Extension contacts external host yoki.games with no CSP, no declared permissions, and zero stated functionality justification.
• Game-cheat/script shell with 17-month-stale update — abandoned low-integrity payload delivery vehicle.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstalled and uninstall URL hijacks active; targets null but hooks confirmed — classic traffic-monetization shell.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email gyanpariksha.in@gmail.com; developer_domain resolves to gmail.com — no verified business entity.
• external_js_host crx JS loaded from yoki.games — unknown third-party game portal with no CSP to restrict execution.
• no_csp manifest content_security_policy is null; MV3 but no CSP means remote JS from yoki.games can execute unconstrained.
• stale_maintenance store Last updated March 4 2025, months_since_update=17 — falls in 6-12mo stale band.
• game_cheat_shell store Title advertises game scripts (Auto Farm, Infinite Spin, Kill Aura) — low-effort game-portal shell pattern.
• privacy_policy_d_clause store PP fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true — v3.5(D) +10.0 privacy.

Pillar Scores

Bookkeeping