Top Risks

• Uninstall URL hijack and install URL hijack detected — classic traffic-monetization shell pattern.
• Default search provider override routes all queries through recipesapp.com/admin/public/link.
• Developer email is free webmail (gmail) with no verified business identity.
• Extension is 16 months stale — elevated takeover/abandonment risk.
• Cookies permission paired with search override enables session tracking across search queries.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to 3rd-party target; traffic-monetization fingerprint.
• install_url_hijack crx onInstalled opens 3rd-party URL; monetization shell pattern confirmed.
• search_provider_override_is_default manifest chrome_settings_overrides sets recipesapp.com as default search with is_default=true.
• free_webmail_developer store Developer email liamrichardson151@gmail.com; no verified business; gmail domain.
• stale_extension store 16 months since last update; elevated abandonment/acquisition risk.
• cookies_permission manifest cookies permission with search override enables persistent session tracking on all searches.
• privacy_policy_adequate api Policy at recipesapp.com/privacy.html fetched; scope/collection/retention/3rd-party all disclosed.
• no_cve_findings crx No CVEs or bad-host hits detected; code_findings_raw empty; obfuscation_score 0.0.

Permissions Breakdown

• storage low Standard local data persistence; minimal risk.
• cookies high Can read/write cookies scoped to recipesapp.com; paired with search override raises concern.
• https://recipesapp.com/* medium Narrow host permission but supports cookie access and search redirect on same domain.
• chrome_settings_overrides.search_provider (is_default=true) medium Silently sets RecipesApp as default search engine; monetization vector.

Pillar Scores

Bookkeeping