The extension is branded as 'StegCloak' (steganography tool per CWS listing) but content. is internally labeled with the webpack bundle ID 'Coeus:' (line 114) and implements an IOC indicator parser that monitors text selections across pages — classifying them as domains, IPs, URLs, or hashes — a capability entirely unrelated to steganography. Crucially, there is no `content_scripts` declaration in and no `host_permissions`, so this code cannot be auto-injected into any webpage and is effectively inert; the third-party chrome-stats score of corroborates the negligible active risk. However, the unexplained code-identity mismatch (StegCloak branding over Coeus IOC-parsing logic) combined with the publisher's 25% malicious rate on other extensions () prevents a clean false-positive clearance; all ML signals are explained by Webpack HMR boilerplate and the 41KB SVG, not genuine malice.