The bundled extension (MV3, v2.0.0, updated 5 days ago) contains only `storage` and `declarativeNetRequest` permissions and implements a straightforward crypto-miner blocker: loads a bundled domain blocklist (, ~1275 miner domains from), creates declarativeNetRequest rules to block matching resource types, and stores state in chrome.storage.local — zero external network calls, no data exfiltration, no obfuscation. The and are standard Webpack-bundled React apps (React 18 + lucide-react) that communicate only with the background service worker via chrome.runtime.sendMessage on path 'ui-to-background'. All ML signals are fully explained by legitimate tooling: js_exclamation (2953) and js_fromcharcode (6) from minified production bundle, js_innerhtml from React's DOM reconciler, js_encoded_strings and btoa from webpack style-loader generating inline source map data URIs. The published-manifest mismatch (MV2 broad permissions vs. bundled MV3 minimal permissions) actually corroborates benign intent — the publisher migrated to MV3 and shed `tabs`, `webRequest`, `<all_urls>`, and content-scripts in this major version update. The chrome-stats policy-violation removal likely refers to the prior MV2 version with its overly broad permissions.