What our analysis found

Mini Golf World is rated caution by Extension Auditor. It comes from a publisher with 28 extensions and was last updated in April 2026.

The bundle supplied is a partial extraction and does not contain the code that drove the ML score::15-20 loads jquery-3.2.1., easeljs-NEXT., howler., CLang. and, none of which are present (13 files supplied vs. the MB JS reported), and _locales/ is missing despite, so this tree could not even load as an extension. Everything I could read is stock and clean: is genuine r75 (its two XMLHttpRequest hits are the loader, and show no appended payload), /*.js are unmodified Bootstrap 5.3.7 with zero chrome.* or cloudapi references, is the stock CodeThisLab __ctlArcade* game-config template, and the CSS is game chrome (the css_behavior hits are:191, html_hidden_elements:1 is the display:none #block_game div at:32); critically, the model's js_eval_function:3 and js_encoded_strings:3 appear in NO supplied file, confirming the scored code is absent. What is visible is unexplained but not a rule-7e finding::12,20 opens / with only reason + (no user data, and that domain hosts the listing's own privacy policy, so it is first-party); the oauth2 block is inert because permissions:[] omits the identity permission; externally_connectable <all_urls> is broad attack surface for an offline golf game but no handler exists in any supplied file; and host permissions are unused here and are plausibly shared-template reuse across this publisher's game portfolio. The bundled manifest matches the published manifest summary exactly, so there is no delayed-update mismatch. The IoC note and the malicious siblings corroborate the ML score but are very likely the same feed import rather than two independent sources, so I am not treating them as evidence; chrome-stats (,) and our own risk engine (0.00) contradict the ML score but only evaluate the same manifest. I cannot clear this extension and I cannot convict it on the code I was given.