Ah so it seems. The webpage for Desktop Bridge says that it features "no malware injection", so I took that to mean it was sandboxed.