Top Risks

• Severely stale: last updated 43 months ago, extension effectively abandoned.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer domain blockwallet.io does not resolve, raising accountability concerns.
• No CSP (MV3 default provides some protection but network calls to 3 external hosts are unconstrained).
• install_url_hijack present: onInstalled opens introduction.html, minor redirect signal.

Evidence

• severely_stale store Last updated November 2022; 43 months since update — maintenance score maxed at 10.0.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• developer_domain_not_resolving api blockwallet.io does not resolve per threat_intel; verified-publisher discount capped at -1.0 per invariant 0c.
• no_csp manifest content_security_policy is null; MV3 so no +2.0 Network penalty, but 3 external JS hosts contacted without policy.
• external_hosts crx 3 external API hosts: api.blocknative.com, api.etherscan.io, ethgasstation.info — legitimate gas APIs but unverifiable post-abandonment.
• install_url_hijack manifest onInstalled opens introduction.html (internal page); low severity but flagged.
• verified_publisher_featured store Extension is verified and featured by Google, partially mitigating reputation; discounts capped due to domain not resolving.
• no_code_findings crx code_findings_raw empty, obfuscation_score 0.0, no CVEs detected.

Permissions Breakdown

• alarms low Used for periodic gas price polling; no user-data access.
• storage low Stores local settings/cached prices; minimal risk.

Pillar Scores

Bookkeeping