oh come on, if an extension comes with no source code it means it comes with a native binary (because otherwise it's JavaScript and there, are, no, good, JavaScript, obfuscation, in, this, world, period), and does it really matter if it has network access ??? it may as well just inject cryptominer to your ~/.bashrc.