A sweep of every absolute URL literal across all 9,854 lines of JS yields only [domain withheld] endpoints, the publisher's own privacy-policy URL ([domain withheld], used solely as an <a href> in the consent dialog at:5247), and a JSZip documentation link; there is no third-party sink, no setUninstallURL, no onInstalled hook, no importScripts and no chrome.scripting call, and:682 (be()) normalizes an [domain withheld] / [domain withheld] hostname to [domain withheld] before fetch while passing any other URL through unchanged. The trio that drove the 8.40 risk-engine score is Instagram API plumbing::42-52 harvests x-ig-app-id / x-ig-www-claim / x-asbd-id / x-fb-lsd into chrome.storage.local,:137-153 reads only the [domain withheld] csrftoken, and the single DNR rule at:271 sets only where initiatorDomains is [[domain withheld]] — so those tokens are replayed to Instagram itself and never leave the browser; the three debug hooks (:290 Nt and:4811 Pe are stripped to empty try{}catch{};:242 R only increments an in-memory counter in this.v) have no network sink whatsoever. Manifest cross-check (step 4): the bundled manifest adds `declarativeNetRequest`, absent from the published CWS summary — most consistent with version drift between this ZIP and the listing scrape given the 5-day-old update, and the only rule it installs is the narrowly self-scoped rewrite above, so it is disclosed-behaviour drift rather than hidden capability. Signals split: the ML 0.84, the 50%-malicious permhash cluster of 2, and chrome-stats' impact are all opinions on this same manifest and are contradicted by the code; the two genuinely adverse signals — `Publisher flagged malicious: yes` and the MalExt Sentry IoC added 2026-04-26 — are also contradicted by v1.1.3, which contains no non-Instagram destination, no remote code loading and no, and since this is a single-bundle review I cannot exclude that the IoC describes a different version than the one analysed here.