The extension claims only to remove YouTube's subscription bar and stop autoplay, but lines 18–77 contain seven undisclosed functions (adss through adss9) that silently replace multiple YouTube ad containers (google_companion_ad_div, user_branded_side_column_image, watch-channel-brand-div, watch-longform-ad, ad300x250, instream_google_companion_ad_div, homepage-sidebar-ads) with iframes pointing to [domain withheld] using the developer's own AdSense publisher ID ca-pub-4964645743880589. This is a classic ad-hijacking scheme: the extension monetizes users by stealing YouTube's ad inventory without any CWS disclosure. The ML score (0.29 medium) and third-party score () both underestimate the risk because ad-injection behavior does not heavily trigger permission-based signals; however, the publisher's 19% malicious-extension rate among their other 27 works corroborates the finding, and the code itself is unambiguous. Notably, the 'legitimate' functionality (GM_addStyle) is a Greasemonkey API that does not exist in Chrome extensions and would silently fail, suggesting the legitimate feature may be vestigial while the ad injection is the actual payload.