Top Risks

• Privacy policy is Google's own policy (myaccount.google.com) — not scoped to this extension at all; data practices undisclosed.
• Install URL hijack: onInstalled opens https://websitemonitoring.pro/welcome, and uninstall URL hijack flag also set.
• Extension is 23 months stale (approaching zombie threshold) with only 280 installs.
• No developer name listed despite verified-publisher claim; accountability gap.
• External JS hosts include api.coindesk.com and several CDNs without CSP — remote code surface not locked down.

Evidence

• privacy_policy_generic store Privacy policy URL points to Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• install_url_hijack crx onInstalled opens https://websitemonitoring.pro/welcome; uninstall_url_hijack also flagged.
• stale_extension store Last updated September 10, 2024; 23 months since update with only 280 installs.
• no_developer_name store developer_name is empty despite verified_publisher=true.
• js_external_hosts crx Loads from api.coindesk.com, getbootstrap.com, github.com, popper.js.org, stackoverflow.com, websitemonitoring.pro — 6 hosts, no CSP.
• no_csp crx content_security_policy is null; MV3 defaults apply but external host loading is uncontrolled.
• verified_publisher store verified_publisher=true; provides partial reputation credit.
• no_cve_findings crx cve_findings_raw empty; jquery 3.7.1 bundled (current, no known CVEs).

Permissions Breakdown

• alarms low Schedules background checks; low risk, expected for monitoring tool.
• notifications low Sends desktop alerts; expected for monitoring tool.
• storage low Stores user configuration locally; low risk.

Pillar Scores

Bookkeeping