Top Risks

• Default search provider override redirects all searches to developer-controlled trackingnumbers.org — traffic monetization vector.
• Uninstall and install URL hijacks both present — hallmarks of low-quality monetization shell.
• Developer is a free-webmail Gmail account with no verified business identity; developer name matches a federal agency (USPS) it has no affiliation with.
• Rating of 1.0 with 50,000 installs strongly suggests user dissatisfaction consistent with deceptive behavior.
• Stale 17 months with no verified publisher and free-webmail identity — elevated acquisition/compromise risk.

Evidence

• search_provider_override manifest chrome_settings_overrides sets trackingnumbers.org as default search engine with is_default=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; monetization shell pattern confirmed.
• install_url_hijack crx install_url_hijack=true; opens 3rd-party URL on install.
• free_webmail_developer store Developer email morancharles916@gmail.com; no verified business; developer name impersonates USPS.
• low_rating store Rating 1.0 across 50,000 installs — severe user dissatisfaction signal.
• stale_extension store Last updated April 2025 but months_since_update=17 suggests listing data inconsistency; scored at 17mo.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• privacy_policy_adequate api Privacy policy fetched, scoped to extension, discloses collection, retention, and third-party sharing.

Permissions Breakdown

• storage low Stores local extension data; no cross-origin exposure.
• host_permissions: *://trackingnumbers.org/* low Narrow host scope limited to developer's own domain.
• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine to developer-controlled trackingnumbers.org; monetization risk.

Pillar Scores

Bookkeeping