The extension does exactly what it advertises: it fetches publicly shared credentials from [domain withheld] and autofills them on the user-clicked page. All network traffic goes to [domain withheld]>, which is the declared and permitted host. The content script only listens for an internal 'fill' message from the popup and writes the received credentials into form fields — no data is exfiltrated, no third-party domains are contacted, and no obfuscation is present. The ML score was likely driven by broad content-script host_permissions ([domain withheld] [domain withheld]) required for autofill on any site, plus innerHTML usage in the popup (which sets known-safe BugMeNot-scraped HTML into the extension's own popup, not into page content). The published MV3 manifest differs from the bundled MV2 manifest (different permissions, different host_permissions structure), but this reflects a newer CWS listing update rather than a covert permission escalation — the bundled version declares fewer permissions.