The extension is exactly what the listing describes: a Minecraft-themed new-tab page ( + + + a local bg.mp4) with a clock, user-editable shortcuts stored in localStorage, and a search box that calls chrome.search.query (:126) to hand the query to the user's own default search engine — there is no redirect to a monetized search feed, which is the hijack pattern that likely drives the 33% malware rate in this `search`-only permhash cluster. (11 lines) only opens [domain withheld] on install and sets an uninstall URL on the same first-party domain (manifest author: "Owhit"), with no parameters or user data attached; there is no anywhere in the bundled JS and contains no url() or http references at all. The ML score, permhash cluster and the "publisher flagged malicious" flag (which traces to the same malext-feed bulk import whose own note says it is "not an independent code review") all contradict the code, while chrome-stats ( impact) and our risk engine corroborate it; confidence is held to medium only because jquery-3.7.1. — present in the signed _metadata file list and accounting for ~87.7KB of the 103,010 scored JS bytes — was absent from the extraction and could not be inspected for appended code. Hygiene only, not findings: shortcut are interpolated unescaped into the template in createShortcuts() (self-XSS from one's own localStorage), and the Rate link still contains the literal placeholder "YOUR_EXTENSION_ID" (:190).