Top Risks

• Uninstall URL hijack redirects to 10xprofit.io marketing page — classic monetization/tracking pattern.
• Amazon brand impersonation by unverified gmail developer with no confirmed ownership.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• Free-webmail developer (gmail) with no verified business identity despite operating a commercial domain.
• Geo-diverse JS hosts (CN, FR, IE, US) increase supply-chain exposure risk for a tiny 20-install extension.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL set to https://10xprofit.io/tools/?utm_source=chrome-extension — third-party redirect.
• brand_impersonation store brand_mention.is_impersonation=true; developer_domain=gmail.com, confirmed_owner=false; title uses 'Amazon'.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic policy admitting sharing.
• free_webmail_developer store Developer email 10xprofitio@gmail.com is free webmail; no verified publisher badge.
• host_geo_diversity crx JS hosts span 4 countries: CN, FR, IE, US — elevated supply-chain risk for a low-install extension.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 default applies but no explicit hardening.
• tiny_install_base store Only 20 installs; low social proof, no ratings — impossible to assess user-reported harm.
• external_js_hosts crx js_external_hosts includes 10xprofit.io, www.google.com; partial host string 'www.' suggests scraping artifact.

Permissions Breakdown

• contextMenus low Used for right-click brand search; matches stated function.
• tabs medium Can open/read tab URLs; needed to open Amazon search tabs.
• storage low Local preference storage; low standalone risk.
• *://*.amazon.com/* (and 22 other Amazon TLDs) medium Scoped to Amazon domains only; matches stated function but grants content-script on all Amazon pages.

Pillar Scores

Bookkeeping