So I just downloaded Oracle and I performed a login on EM and looked under Chrome's network activity tab and this is what Oracle is doing.

https://imgur.com/a/z1JnL

If you look at the part that is boxed in red, you can see that EVERY time you log in, Oracle is automatically sending a GET request to the following ip address: http://45.63.17.67/

Included with that request are a few suspicious parameters. I believe the p parameter (circled in red) is a hashed version of your password.

So whats probably going on is...every time you log in...Oracle takes a copy of your password, sends it to 45.63.17.67 (a server that is "epicmafia.net" and saves it somewhere. So the extension is just building a database of usernames and passwords.

For reference..here is what a log on looks like without Oracle.

https://imgur.com/a/9K1ov

Notice how without Oracle there is just a simple login POST to epicmafia.

You can try this yourself with the following steps.

Install Oracle on the chrome web store

Log out of your account

Right click on your screen and click inspect element

Go to the Network tab

Perform a login

Then you'll see in the network tab that your browser is making a get request to an ip address owned by lailai and its sending a few hashed parameters

There is no reason why Oracle needs to make this request. Nothing about oracle's functionality requires it. It's very likely that it is just logging your password and saving it