The extension is a straightforward cursor skinner::20-34 builds a single <style> element setting `cursor: url(<data-URI>)` from a canvas toDataURL stored in chrome.storage.local (:61-74), and that is the only thing injected into pages. There is no, no, no cookie, webRequest or scripting access anywhere in the three bundled JS files; the only outbound URLs are bare `[domain withheld] (:16 install tab, setUninstallURL,:621 link) with no query parameters or install ID, and [domain withheld] is the listing's own privacy-policy domain, so it is first-party and carries no data. The bundled manifest matches the published manifest exactly (storage only, content_scripts, WAR cur/*), which contradicts the signals; the Unit42 IoC listing and the templated build (:21 still carries the id 'demonslayer-impact-cursor-style' from a sibling cursor extension) are real context for a mass-produced extension farm, but v1.01.03 appears to postdate the 2025-08-19 IoC and its code shows none of that behaviour — confidence is capped at medium only because jquery. (~90KB, present in the signed) was not supplied for review.