This is a legitimate enterprise productivity extension published by Dropbox Inc., a verified Google trusted publisher with a US presence and a valid support email. Every file available for review is benign: sets a first-party cookie exclusively on *.[domain withheld] pages to signal extension presence to Dropbox's own webapp, and loads Dropbox-branded SVG assets from [domain withheld] for dark-mode favicon management. The bundled manifest matches the published CWS manifest exactly (permissions, host_permissions, web_accessible_resources, declarative_net_request with empty rule_resources). The ML score is driven by large minified bundle size (~11 MB), high counts from React's virtual DOM reconciliation, and calls to Dropbox's own APIs — none of which are malicious in context. Third-party risk score () corroborates permissions breadth but is explained by the extension's core function ( search overlay). The permhash cluster likely flags both versions of this same beta extension, not independent malware.