All four JS entry points are webpack bundles whose lines 4-3488 are jQuery 2.2.4 - verified structurally identical across the four files after masking every identifier (same SHA256, b003a5d0463c04, differences are purely per-bundle minifier name allocation) - which accounts for essentially every ML regex hit: XMLHttpRequest, appendChild, innerHTML, fromCharCode and the \x escapes. The few hundred lines of application code implement exactly the listed product and have zero network egress: no fetch, ajax, WebSocket or sendBeacon call in any app region, no hardcoded or dynamically built domain, no base64 blob 60 chars or longer, and the only URLs in the whole bundle are the [domain withheld] SVG namespace and a [domain withheld] demo link in the popup. The Critical risk-engine score and the 7%-malicious permhash cluster are manifest-shape opinions the ML model already consumes and are contradicted by the code, chrome-stats' own likelihood is and its 0.55 'fingerprint match' is explained by the shared jQuery bundle; the one genuine defect is hygiene, not security - handleStorage at:3835 calls the visited site's localStorage.clear() when its own canvas snapshot exceeds quota, destroying that site's stored state, which is sloppy rather than malicious and matches the 'bugs and glitches' review feedback.