Is google meet extension safe?

/**
 * meet-ext-decrypt.js
 * Decrypts enRequest payloads from Google Meet Extension (dghkhbmpagbapkadlehcicngkldfieln)
 * using the hardcoded AES-GCM key from background.bundle.js:2810.
 *
 * Usage:
 *   node meet-ext-decrypt.js
 *   node meet-ext-decrypt.js '<base64_enRequest_value>'
 *
 * Requires: Node.js 18+ (built-in webcrypto)
 */

const crypto = require('crypto');

// Hardcoded key extracted from background.bundle.js line 2810:
// new function(e, t, r) { ... }("KcDvSvXBxOvVCk7z", "0ipnBjZ7oFir6SVP", "http://stream.meetextension.com")
const AES_KEY = "0ipnBjZ7oFir6SVP";  // 16 chars = 128-bit AES-GCM key

async function decrypt(base64Payload) {
  // Strip surrounding JSON quotes if present
  const clean = base64Payload.replace(/^"|"$/g, '');
  const raw = Buffer.from(clean, 'base64');
  // First 16 bytes are the IV, rest is ciphertext
  const iv = raw.slice(0, 16);
  const ciphertext = raw.slice(16);

  const keyBytes = Buffer.from(AES_KEY, 'utf8');
  const key = await crypto.webcrypto.subtle.importKey(
    'raw', keyBytes, 'AES-GCM', true, ['decrypt']
  );
  const plaintext = await crypto.webcrypto.subtle.decrypt(
    { name: 'AES-GCM', iv }, key, ciphertext
  );
  return new TextDecoder().decode(plaintext);
}

async function main() {
  if (process.argv[2]) {
    // Decrypt a specific captured payload
    console.log('Decrypting captured payload...');
    try {
      const result = await decrypt(process.argv[2]);
      console.log('Decrypted:', result);
      // Pretty-print if valid JSON
      try {
        const parsed = JSON.parse(result);
        console.log('\nParsed:');
        if (Array.isArray(parsed)) {
          parsed.forEach((entry, i) => {
            console.log(`  Entry ${i + 1}:`);
            console.log(`    targetUrl:       ${entry.targetUrl}`);
            console.log(`    referrerUrl:     ${entry.referrerUrl}`);
            console.log(`    userId:          ${entry.userId}`);
            console.log(`    fileDate:        ${entry.fileDate}`);
            console.log(`    deviceTimestamp: ${entry.deviceTimestamp}`);
          });
        }
      } catch {}
    } catch (e) {
      console.error('Decryption failed:', e.message);
    }
  } else {
    // Demo: show what a captured payload decrypts to
    console.log('No payload provided. To decrypt a real captured request:');
    console.log('  1. Capture a POST to http://stream.meetextension.com/process in your browser DevTools.');
    console.log('  2. Copy the value of request.enRequest from the JSON body.');
    console.log('  3. Run: node meet-ext-decrypt.js \'<enRequest_value>\'');
    console.log('');
    console.log(`AES-GCM key (hardcoded in extension): ${AES_KEY}`);
    console.log('Format: base64(IV[16 bytes] + AES-GCM-ciphertext)');
  }
}

main().catch(console.error);