Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by malext.io
Get Transit Schedules
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Analyzing extension security...
AI Security Report
AI Security Review
Evidence context: threat category unknown malware; evidence quality moderate.
The Get Transit Schedules extension presents a mixed security profile. The core functionality appears legitimate: the extension communicates with gettransitschedules.com for privacy policies, terms of service, and transit data endpoints like /admin/public/autosuggest?searchTerm= and /admin/public/link?q=. These are expected behaviors for a transit schedule service.
The extension also contacts clients2.google.com, specifically the Chrome extension update service at /service/update2/crx. This is standard, legitimate behavior for Chrome extensions to receive updates from Google.
However, one finding requires clarification: the domain win.id appears in the IoC findings. This domain is not the extension's own service, not a CDN, not Google infrastructure, and not an analytics provider. Without documentation explaining what win.id provides, this could represent affiliate tracking, ad injection, or data collection. The extension description makes no mention of this domain or its purpose.
The developer identity is a generic Gmail address ([email protected]) rather than a verified company account. While not inherently malicious, this limits accountability if the extension's behavior changes.
Several findings are known false positives: the IPv6 fragments :: and e::af are IoC extractor artifacts from hex substrings in minified JavaScript, not real IP addresses. The 8 code-smell findings trigger on basic JavaScript patterns and are noise, not evidence of malicious code. There are zero malware signatures and zero obfuscation detections, which is a positive signal.
Counterargument: A skeptic might argue that the extension is benign because it has no malware signatures, no obfuscation, and the primary domain (gettransitschedules.com) aligns with the extension's stated purpose. The code-smell findings are expected noise, and the Google update endpoint is standard. However, the win.id domain remains unexplained. If this is an affiliate or tracking domain, it could represent privacy concerns or ad injection that would not show as malware. Without runtime analysis or developer documentation explaining win.id's purpose, the risk cannot be fully dismissed.
Recommendation: Runtime analysis to determine what data is sent to win.id and whether user browsing data is exfiltrated would resolve the uncertainty.
Key Reasons
- Unexplained third-party domain win.id in network communications
- No malware signatures or obfuscation detected
- Generic Gmail developer account instead of verified publisher
- IPv6 fragment IoCs (::, e::af) are known false positives
- Code-smell findings are expected noise on basic JavaScript
False Positive Considerations
- IPv6 fragments (::, e::af) from IoC extractor
- Code-smell YARA rules on basic JavaScript patterns
- Google update service (clients2.google.com) flagged as IoC
Reviewed 2026-05-24; recommended action: runtime analysis; model confidence 65%.
Source Code Not Available
Source code is not available for this version of the extension.