This is the TTV-AB Twitch ad-blocker ( header: 'TEV v85.8.9 - Twitch Ad Blocker', links to [domain withheld]) plus first-party JeetBot features, and every network destination maps to Twitch,, Shazam or the publisher's own [domain withheld] / [domain withheld] / [domain withheld] infrastructure — exactly what the Entertainment listing advertises. The code is unusually defensive with credentials rather than exploitative: the captured Twitch Authorization header is held in service-worker memory only (:177, explicitly never persisted at:3165-3170), is used solely against [domain withheld], [domain withheld] and [domain withheld], and both the runtime fetch wrapper (:1030-1060, 1133) and the dynamic DNR rules (:1469-1500) strip before anything reaches a playlist proxy. The permhash cluster ( 'malware') and the internal note both trace to the 2026-09-13 malext feed import rather than independent code review, and the chrome-stats impact is a restatement of the same manifest; neither is corroborated by anything I found in the source. Caveats, not findings: the bundled 85.8.9 manifest differs from the published-manifest summary (published shows and [domain withheld] / [domain withheld]; bundled drops both permissions, adds identity and the hosts) — the bundle is the newer build and the drift reduces power rather than expanding it; DNR rule 100002 in sets Access-Control-Allow-Origin '*' together with Allow-Credentials 'true' on the publisher's own [domain withheld] API, which is sloppy CORS hygiene; and routing [domain withheld] playlists through publisher proxies necessarily exposes watched channel and IP to [domain withheld] while the CWS data-collection disclosure says 'none declared', a compliance gap rather than covert exfiltration.