A scary code match is not the same as scary extension behavior.

What a permission check sees

The manifest requests only storage access. Looking at that permission alone gives little reason for concern and says nothing about code packaged inside individual game maps.

What a code search finds

In maps/exit_8.js, lines 476 and 479 construct an instruction that downloads JavaScript from awehero.github.io and passes the downloaded text to eval(). That pattern deserves investigation because remotely hosted code can change without a new Web Store package.

if (chrome.runtime.id) {
  alert(`Play the full version on the website. You cannot save replay files in this mode.`);
  alert(`Your goal is to try to get to the purple crayon, but be careful of the lava!`);
  eebafe();
} else {
  eval([`fetch(\`https://awehero.github.io/intro/maps/exit_8_code.js\`).then(response`, cc.set_default.toString().substring(43, 44), `>response.text()).then(data`, cc.set_default.toString().substring(43, 44), `>{eval(data);}).catch(error`, cc.set_default.toString().substring(43, 44), `>{console.error(\`errorfetchingscript:\`,error)});`].join(``))
}
} else {
  eval([`fetch(\`https://awehero.github.io/intro/maps/exit_8_code.js\`).then(response`, cc.set_default.toString().substring(43, 44), `>response.text()).then(data`, cc.set_default.toString().substring(43, 44), `>{eval(data);}).catch(error`, cc.set_default.toString().substring(43, 44), `>{console.error(\`errorfetchingscript:\`,error)});`].join(``))
}

What following the branch reveals

The surrounding code checks whether it is running with a Chrome extension identifier. When that identifier is present, it shows instructions and calls bundled code instead. The remote download-and-evaluate branch is reached only when that extension identifier is absent, such as the shared website version.

Based on this package, the remote branch exists in the distributed source, but we did not establish that the installed Chrome extension executes it. Chrome also restricts remotely hosted code in Manifest V3 extensions. That makes this a review-worthy implementation detail—not proof that the extension is malicious or currently runs downloaded code.

Why semantic analysis matters

• Permissions alone miss it: the manifest cannot explain this source path.
• A pattern match overstates it: two eval() calls do not establish that Chrome reaches them.
• Context produces the useful answer: trace the source, destination, runtime checks, and reachable branch before assigning risk.