The extension is a legitimate academic research tool developed by Gale (Cengage Learning). It injects library search results into Google SERPs using content scripts on [domain withheld] and [domain withheld], and sends to Gale’s API ([domain withheld]) for authentication and search. Analytics are sent to Google Analytics (UA-29808940-37) for usage tracking. All network destinations are declared in permissions and are necessary for core functionality. There is no obfuscation, code injection, or data exfiltration beyond the disclosed purpose. The ML model’s regex hits (e.g., xmlhttprequest, innerhtml) are typical in content-script UIs and minified analytics libraries, not malicious indicators.