The bundled source code is a 57-line jQuery DOM automation script () that does exactly what the listing describes: it polls for Google Meet's 'Ready to join?' prompt, overlays a 7-second countdown, and clicks the 'Join now' / 'Ask to join' button when the timer expires. There are zero network requests, zero external data flows, no constructor calls, and no obfuscation of any kind. The ML score of 0.85 is almost certainly driven by the permhash cluster artifact — 130,891 extensions share the same empty-permissions signature, and 36% of that broad bucket are malicious, but that baseline rate does not survive a direct code review. The IoC flag citing the DarkSpectre blog post is the only meaningful counter-signal; however, the actual code contains none of the hallmarks of that campaign (no data exfiltration, no remote script loading, no credential harvesting), and the extension bears valid dual signatures from both publisher and Google's webstore key in The published CWS listing advertises MV3 while the bundled manifest declares MV2, suggesting the listing metadata was updated without a corresponding CRX re-upload, which is a minor housekeeping issue and not a security concern given the benign code.