Top Risks

• NewTab override combined with install and uninstall URL hijack patterns typical of traffic-monetization shells
• DOM-XSS sink (innerHTML from variable) present in js/news.js with no CSP defined
• Fan-content shell pattern: Hollow Knight/Silksong-themed live wallpaper from unrelated operator (tabplugins.com)
• Install and uninstall URL redirection indicates traffic arbitrage intent despite low current install count
• Privacy policy admits third-party data sharing without disclosed retention

Evidence

• install_uninstall_hijack crx install_url_hijack=true and uninstall_url_hijack=true; targets null but flags set
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; categorized as NewTab
• fan_content_shell store Hollow Knight Silksong live wallpaper by ExtNext/tabplugins.com (unrelated game IP)
• dom_xss_sink crx code_findings_raw: dom_sink_innerhtml_userctrl in js/news.js; CSP absent
• external_hosts crx 7 external hosts incl. chatgpt.com, instagram, x.com, youtube; geo diversity 3 countries
• privacy_policy api Fetched; scoped to extension; data collection and third-party sharing disclosed; retention missing
• maintenance store Last updated ~1 month ago; actively maintained
• reputation store 803 installs; not verified; domain age 532 days; no reviews; no operator cluster

Permissions Breakdown

• search medium Declared search permission (minor)
• chrome_url_overrides.newtab medium New-tab override with monetization shape
• host_permissions: https://tabplugins.com/* low Narrow host access to developer domain

Pillar Scores

Bookkeeping