Top Risks

• Stale extension (31 months since update) — abandoned, unpatched if vulnerabilities emerge.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Free-webmail developer (gmail) with no verified business identity or domain.
• No CSP declared (MV3 mitigates somewhat but adds no explicit restriction).
• new Function() constructor in bundled JS; low-risk in context but elevated by absent CSP.

Evidence

• stale_extension store Last updated November 2023; 31 months since update — zombie risk.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email nftdevsquad@gmail.com — no verified business domain.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• function_constructor crx new Function() found in scripts/scss.js — likely bundler artifact but unverifiable without CSP.
• low_installs store Only 8 installs; no community signal to assess safety or malicious behavior.
• external_hosts crx Contacts dashboard-api.memeland.com and genesis-api.keungz.com; both NFT-adjacent, no bad-host hits.
• no_verified_publisher store No verified publisher badge; individual developer with gmail address.

Permissions Breakdown

• declarativeNetRequest medium Can block/redirect network requests; scoped to ruleset, not arbitrary interception.
• host_permission: https://genesis-api.keungz.com/teaming/token-info low Narrowly scoped single-endpoint host permission for NFT data lookup.
• content_scripts: *://opensea.io/* low Scoped to opensea.io only; matches stated function of displaying NFT info.

Pillar Scores

Bookkeeping