The extension's source code is a straightforward Wildberries marketplace analytics tool that does exactly what its description claims: it reads product article IDs from [domain withheld] URLs and fetches data from the publisher's own backend ([domain withheld]) using the user's own subscription token stored in localStorage. Every network call goes to [domain withheld] — the publisher's declared domain — making this first-party communication by definition, not exfiltration. The ML score of 0.30 is driven by (legitimate UI templating in), a single XHR (to the publisher's own API), and minified library bundling (Chart. + jQuery); none of these indicate malice in context. The chrome-stats likelihood score of corroborates this read. The permhash cluster flag and publisher's other extension being marked malicious are corroborating signals that were weighed but do not override the clean source code.