The entire first-party codebase (13.3 KB across,,,,) does exactly what the listing claims: it stores a chosen cursor path in chrome.storage.local, rasterizes a packaged image via canvas.toDataURL() (:61-74), and injects a single <style> element setting cursor: url(data:...) into pages (:20-34). There is no fetch, XMLHttpRequest, eval, Function(), atob, WebSocket or sendBeacon anywhere, no host_permissions, and the only declared permission is storage; the bundled manifest matches the published CWS manifest exactly (MV3, permissions [storage], content scripts on *://*/* at document_start, web_accessible_resources cur/*.*). The Unit42 IoC listing is addressed but not reproduced in code: the only outbound behaviours are an install-time tab, setUninstallURL and a 'Get More Cursors' link, all three to [domain withheld], which is the publisher's own declared website (:16-18, 23-25;:513), so any PUP harm would live server-side on that landing page, not in this package. Confidence is medium rather than high only because jquery. is listed in but was not included in the extract dir, leaving roughly 90 KB of popup-scope code unread; the publisher's leave-one-out malicious record contradicts the ML score, the storage-only permhash cluster (194k versions) is generic, and the chrome-stats likelihood reasons are stale (it flags 'added in the past 3 months' for a 422-day-old extension and 'bad user rating' for a 4.5 rating).