What our analysis found

Pacman Popup, used by 100,000 people, showed no malicious code in Extension Auditor's review. It comes from a publisher with 4 extensions and was last updated in July 2024.

Source code review reveals a clean, self-contained Pac-Man game port (attributed to) with zero Chrome permissions. The single `fetch` call at:3178 loads local audio files via `this.baseUrl = ' /'` (relative path, no external host). `localStorage` is used only to persist high score and volume preference (:1296, 1539, 1912, 2015). No `eval`, no external network calls, no `chrome.*` API use, no obfuscation. The ML score (0.52) is fully explained by the large asset count (162 files, 143 images) and routine game-UI DOM manipulation (`innerHTML` for score display, `appendChild` for sprite elements). The chrome-stats fingerprint match (0.915 to known malware) carries zero impact since the extension has no permissions; the matched extension likely also had zero permissions, making them near-identical in permission-feature space. The publisher's malicious other-extension record is the only genuine concern, preventing a `false_positive` verdict, but the actual code in this extension contains no harmful behavior.