The extension is a small, unobfuscated, fully readable SOCKS5 proxy switcher: `:327` sets `chrome.proxy.settings` to a hardcoded `socks5` server at `*.[domain withheld]` (first-party, matching manifest `homepage_url`), `releaseTunnel` at `:359` reverts to `mode: "system"`, and the two host permissions are used only for DNS-over-HTTPS A-record lookups of that same proxy hostname (`:211-241`) so the proxy domain can be reached by IP. There are no content scripts, no permissions, no eval or remote code, no remote config and no outbound call carrying user data; bundled and published manifests match exactly. Contradicting the ML score: publisher reputation is malicious leave-one-out, chrome-stats' 'permission-clipboard' reason is factually wrong (no clipboard permission exists in either manifest), the malext internal note states it is a feed import and 'not an independent code review', and the 77% malware rate in the permhash cluster is likely circular with that same feed rather than independent evidence. Real but non-code-security concerns that keep this at likely_benign rather than false_positive: the 'Premium' gate is purely client-side and fake (`us-1` free and `us-2`/`us-3` premium share an identical host and port in `:6-33`), the upsell funnels to a third-party referral link (`:216-217`, `[domain withheld] and `[domain withheld]`), and a plaintext SOCKS5 relay marketed as a 'secure VPN' lets the operator observe all non-TLS traffic — deceptive marketing and an affiliate funnel, not malicious code.