This is a straightforward Gmail integration for NeoCertified secure email (in business since 2002, Google trusted publisher badge present). The entire functional code is (opens [domain withheld] in a popup) and (uses InboxSDK to add a nav item in Gmail pointing to the same first-party domain). The ML score is driven almost entirely by the bundled InboxSDK library — 155KB of minified third-party code that accounts for all the js_createelement_script, xhr, and encoded-string hits. One genuine supply-chain concern: InboxSDK loads a remote implementation script from [domain withheld] at runtime inside the Gmail tab. Notable discrepancy between bundled manifest (MV2, empty permissions, gmail-only content scripts) and live CWS manifest (MV3, 'scripting' permission, host_permissions including *://*/*) — likely reflects a MV3 migration push, not a staged malicious permission expansion, given the extension age and publisher credibility; mentioned in rationale rather than findings per category restrictions under this verdict.