Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business identity raises accountability concerns.
• No CSP present (MV3 default is stricter but no explicit policy); innerHTML sink in bundled React could be exploited.
• new Function() constructor in popup.js is a moderate code-quality risk.
• Extension is 18 months stale — at the boundary of the 6-12 month maintenance band.

Evidence

• free_webmail_developer store Developer email martijnpublicdev@gmail.com — no verified business domain.
• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• code_function_constructor crx new Function() in popup.js — moderate arbitrary-code risk.
• code_innerhtml_sink crx innerHTML assignment in 28.js; no CSP — DOM-XSS risk elevated (FIX B).
• react_16_13_1_bundled crx React 16.13.1 bundled; no CVEs flagged in cve_findings_raw but below 16.14 patched versions.
• maintenance_stale store Last updated December 30 2024; 18 months — 6-12mo band score +3.5.
• is_featured_by_google store Extension carries Google Featured badge; partial reputation discount applied.
• no_bad_hosts_no_monetization api threat_intel shows no bad_host_hits, affiliate_hits, or monetization_hits.

Permissions Breakdown

• storage low Stores portfolio data locally; low risk.
• alarms low Schedules price-check polling; low risk.
• notifications low Sends price alerts; low risk.
• host: https://api.etherscan.io/ low Scoped to single blockchain API; matches stated function.
• host: https://etherscan.io/ low Scoped to single blockchain explorer; matches stated function.

Pillar Scores

Bookkeeping