What our analysis found

Hit VPN showed no malicious code in Extension Auditor's review. It comes from a publisher with 10 extensions and was last updated in July 2026.

All three JavaScript files (,,) plus and are short, unminified, and do exactly one thing: on a user click in the popup (:144 →:146) they call chrome.proxy.settings.set with mode 'fixed_servers' pointing at (:26-48), a subdomain of the extension's own domain (:10-11), and clear it again on disable. There is no, no content script, no host_permissions, no, and no remote url() or @import in; the decoded signed file list contains exactly the 12 files present, so no JS is hidden from the bundle, and the bundled manifest's permissions (proxy, storage) match the published manifest exactly. Contradicting the signals: chrome-stats' only impact reason is 'permission-clipboard', a permission this manifest does not request and which appears nowhere in the code; the publisher's malicious record, the 38%-malware permhash cluster and the malext-feed note (which self-describes as 'not an independent code review') are all context the model already consumes, not code evidence. It is not a clean false_positive because the extension is a VPN-template build (THEME: 'batch-02-v-b-rounded-square', publisher privacy policy titled 'Touch-VPN', anonymous policy) whose operator is unaccountable and server-side necessarily observes every hostname and all plain-HTTP traffic — unverifiable from code — and the CWS 'none declared' data-collection entry is a disclosure gap against that; the install-time landing-tab open (:121-123) is a hygiene annoyance, not a security finding.