Top Risks

• Extension not updated in 38 months (>36mo stale) — zombie maintenance risk.
• Privacy policy covers hipcamp.com broadly; scope_extension=false and admits data collection + 3rd-party sharing.
• NewTab override replaces user's new-tab page; triple-stale fingerprint (>24mo + MV3 + stale).
• CSP connect-src uses 'https://*' (broad) — wide outbound reach from new-tab context.
• react-dom bundled with innerHTML sink; no CSP script-src restriction elevates DOM-XSS risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; medium-risk permission scored per v2 calibration (a).
• maintenance_stale store Last updated April 2023, 38 months ago; +10.0 maintenance + zombie booster not triggered (<10K installs).
• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 (v3.5 rule D).
• csp_connect_src_broad crx connect-src includes 'https://*' — broad outbound allowed from new-tab page.
• dom_sink_innerhtml crx react-dom.production.min.js has innerHTML sink; CSP has no script-src restriction; +0.5 code quality.
• verified_publisher store Verified publisher badge present; hipcamp.com resolves; -3.0 reputation floor applied (floor=2.0).
• newtab_webstore_signal store NewTab category +2.0; triple-stale (>24mo+MV3+stale) +2.0; search_engine_count=1 no anomaly.
• no_bad_hosts api threat_intel: bad_host_hits=[], affiliate_hits=[], monetization_hits=[], sibling_count=0.

Permissions Breakdown

• chrome_url_overrides.newtab medium Replaces new-tab page; matches stated purpose but is a monetization-risk surface.
• host_permissions: https://www.hipcamp.com/graphql low Narrow host permission scoped to own domain's GraphQL endpoint only.

Pillar Scores

Bookkeeping