Top Risks

• Brand impersonation of Discord by a free-webmail Gmail developer with no verified identity.
• Uninstall URL hijack detected — redirects users to third-party on removal.
• Broad access to discord.com enables exfiltration of messages, credentials, and tokens.
• Privacy policy admits data collection and third-party sharing but lacks retention disclosure.
• 8 external JS hosts including ipinfo.io (IP geolocation) with no CSP to constrain them.

Evidence

• brand_impersonation store Extension mentions 'discord' brand; developer is gmail user abel.sonmerfield, confirmed_owner=false.
• uninstall_url_hijack crx uninstall_url_hijack=true; redirects user on uninstall to unverified third-party destination.
• free_webmail_developer store Developer email abel.sonmerfield@gmail.com; no business domain; no verified publisher badge.
• broad_host_discord manifest host_permissions include *://discord.com/*; content_scripts injected on all discord.com pages.
• external_hosts crx 8 external hosts contacted: api.discordmate.com, ipinfo.io, feross.org, github.com among others.
• no_csp manifest content_security_policy is null; no CSP to restrict script sources or network connections.
• privacy_policy_third_party api Policy at vimego.io admits data_collection=true, third_party_sharing=true, retention=false.
• function_constructor crx new Function() constructor used in background.js; dynamic code execution risk.

Permissions Breakdown

• activeTab low Grants access to current tab on user action; scoped to discord.com via content_scripts.
• scripting medium Allows dynamic script injection into pages; paired with discord.com host access.
• storage low Local extension storage; low standalone risk.
• *://discordmate.top/ medium Host permission to developer-controlled domain; exfil relay possible.
• *://discord.com/* high Broad access to Discord — captures messages, tokens, PII at scale.

Pillar Scores

Bookkeeping