The bundled 2.7.4 declares host_permissions:[] and permissions:[] (:29-30) while the live CWS listing declares host access to [domain withheld], wheel.cloudapi.stream and mines.cloudapi.stream — the version users run is not the version in this ZIP, and the hosts it grants itself are subdomains of the C2 domain named in both internal IoC notes ([domain withheld] 108-extension campaign). The game itself is an unmodified licensed CodeThisLab HTML5 template (, with CTL arcade hooks and a [domain withheld] credit at:5061, single innerHTML at:798 writing an iOS fullscreen @media probe, bootstrap clean of any chrome.* or network call), so the ML counters that drove 0.99 — 1.27 MB of JS, 205 files, 77 images, hits — are measuring a game bundle, not malicious code; the risk engine's 0.00 and chrome-stats' see only the empty permission set and corroborate nothing either way. What tips this past 'suspicious' is the staging: a never-displayed.gameSession div (:32-36) that pulls an image and link from multiaccount.cloudapi.stream on every page open with no JS anywhere referencing it, externally_connectable accepting <all_urls> (:17-19) with no onMessageExternal handler to justify it, a sandbox CSP granting unsafe-eval with no sandbox page declared, pings to cloudapi.stream carrying only the reason and [domain withheld] (:17,22 — first-party by the publisher's own cdn.cloudapi.stream privacy policy, so not a finding), and a publisher at malicious leave-one-out. Confidence is capped at medium because the bundle is partial::15-18 loads jquery-3.2.1., createjs., howler. and CLang., none of which are present, _locales/ is absent despite __MSG_ usage, and CLang. is not a recognised vendor library — the payload may well live in the files I could not read.