All 7 bundled files implement exactly what the listing describes: an MV3 new-tab override that plays a bundled local video (:3 ' '), shows a clock, sticky notes stored in localStorage, shortcuts, and a search box that routes through chrome.search.query (:169) using the user's own default engine — no search hijack, no redirect, no affiliate rewrite, which is the usual malicious behaviour in new-tab farms. No user data ever leaves the browser: every network call is a parameterless GET to [domain withheld] (:21,:41), which matches the author 'Gameograf', the contact, and the single declared host permission; the bundled manifest matches the published CWS manifest exactly. The reason this is likely_benign rather than false_positive is a remote-content channel::54 assigns server-supplied HTML from [domain withheld] into the new-tab DOM, and:21 lets the server define the shortcut URLs — with no content_security_policy key the MV3 default script-src 'self' applies, so injected <script>, on*= handlers and javascript: hrefs cannot execute, making this a remotely-steerable surface rather than code loading, but it is a post-review monetisation or phishing lever. The:19-25 indexedDB wipe runs in the service worker and therefore only sees the extension's own origin (self-cleanup, not site-data destruction). Confidence is medium because is listed in but absent from the bundle (~87 KB of the reported 99,735 total JS bytes), so I could not verify it is stock jQuery. The ML score of 0.79 and the malext-feed note are contradicted by the code — the feed note itself says it is 'not an independent code review' with 'no affected version supplied', and the listing is still active; the permhash cluster (search + one host) is the generic wallpaper-extension fingerprint and, given the 2026-09-14 feed import, is not independent corroboration. chrome-stats and the publisher's (1%) are consistent but are context, not evidence.