What our analysis found

Ground News - Bias Checker, used by 40,000 people, showed no malicious code in Extension Auditor's review. It comes from a trusted publisher and was last updated in March 2025.

Every line I could read implements the advertised bias-checker:: look the current tab URL up at the first-party:2935-2949 and the modules insert a Ground News coverage badge built with (no innerHTML of remote data), embed ground.news toolbar iframes, and:2399 posts a trackOpen ping to production.checkitt.news carrying a refId returned by ground.news itself plus a ground.news-issued sessionID captured only on?extAuth=true (:3021-3035) — no, no atob, no cookie access, no remote script loading, no dynamic host beyond ground.news. Two caveats keep this at medium rather than false_positive: the signed lists 52 files for 3.1.2 including (a document_start content script on and) and the real bundled, neither of which was provided for review, and they plausibly hold the ML counters absent from every file I did read (0 of 5 XMLHttpRequest, 0 of 2 createElement('script'), 0 of 53 \x hex escapes, 2 of 25 innerHTML, 0.78 MB of 4.2 MB JS). Contradicting signals: the live listing adds and a fonts web_accessible_resources entry absent from the bundled 3.1.2 manifest — a newer build declaring a host permission for a backend 3.1.2 already calls, so this verdict covers 3.1.2 only; the full tab URL (query and fragment included) is sent on every navigation while CWS data collection is "none declared" — first-party destination so not a finding per the disclosure cross-check, but it is undisclosed web-history collection; and the MalExt IoC carries no affected version and self-describes as not an independent code review, while the "invalid" publisher email and the "website" are scrape artifacts, none corroborated by 3.1.2's code.