The extension is a self-contained cursor skinner: lists 180 bundled files,:61-75 rasterises the selected.cur through a canvas and stores the resulting data: URI in chrome.storage.local, and:20-34 injects one <style> element setting cursor: url(<that data URI>). A grep across every file for fetch, XMLHttpRequest, sendBeacon, WebSocket, eval, new Function,, chrome.cookies, chrome.webRequest, chrome.scripting and chrome.declarativeNetRequest returned zero hits, so there is no network egress or dynamic code path at all; the bundled manifest (storage only, content script *://*/*, WAR cur/*.*) matches the published manifest exactly. Contradicting signals: the Unit42 IoC listing and the publisher's malicious rate are real, and the only PUP-flavoured mechanism present is:16-24, which opens a UTM-tagged [domain withheld] install tab and sets the same URL as setUninstallURL - a third-party affiliate landing page that is not the declared [domain withheld] privacy host, but it receives only a static navigation with no user data, so it is monetisation hygiene rather than exfiltration. I withhold false_positive because jquery. (~90 KB, present in and accounting for the bulk of total_js_size_bytes) was not included in the extracted bundle and could not be verified as stock jQuery.