Castorus is a genuine 2423-day-old French real-estate listing tracker and the overwhelming majority of the code matches that purpose: `webRequest` is used only for tracking (:221-239), there is no anywhere, the 161 `js_hex_obfuscation` hits are all `\x3c!--`/`--\x3e` escaped HTML comment markers in shadow-DOM CSS templates, and the 3 `js_fromcharcode` hits are an XOR wrap of the extension's own auth token (:130,136). What I cannot square with the listing is `self.castorus.down()` (:100-191): on an alarm every ~120 min (:24) the extension fetches a crawl target URL from its server, decodes it with a hand-rolled substitution cipher (:14-21), then prefers to issue that request from inside a non-active background tab's MAIN world with `credentials: 'include'` and the page's own referrer under a flag literally named `stealthTier` (:260-303), making the user's authenticated session and IP a scraping proxy for pages they never visited — whereas the store listing scopes the product to "les annonces que vous consultez". Signals disagree and I weighted them accordingly: the permhash cluster (51% malicious) is just `<all_urls>`, an extremely common set, chrome-stats' impact is an opinion on the same manifest, and the internal IoC note cites a WhatsApp-spamware write-up that is contradicted at code level (zero `whatsapp` hits in 48 files) — so none of those corroborate; the finding below stands on the code alone. Two mitigations keep this short of malicious: the *upload* is soft-gated, since `down()` passes `id_site = getIdSiteForDomain(...)` (:137) and `sendDataJson` returns null for a non-integer id_site (:203-204), and full gzipped HTML ships only when the server config `blobActived` is true (default false,:27-30;:150,171) — but both gates are set by the same server that supplies the target URL, so they bound third parties, not the publisher. Caveats: ` ` (which defines every `API_*` endpoint constant), ` ` and ` ` are listed in ` ` but absent from the bundle, so the [domain withheld] destination is inferred from host_permissions and the product rather than verified, and `handleDownPost` calls an undefined `self.castorus.downPost`; the bundled manifest's permissions and host_permissions match the live listing exactly, but its web_accessible_resources add two renderer files, so bundle and listing are not byte-identical. The page-to-extension postMessage relay (:41) has no origin check, but it only reaches `toggleFavorite`, `openAutoLoginUrl` and `refreshData` — it does not expose the privileged fetch — so that is hygiene, not a finding.