This is a small, entirely unminified 6-file MV3 proxy client that does exactly what its listing describes: it sets chrome.proxy.settings to mode 'fixed_servers' with a SOCKS5 host taken from a hardcoded list of *.[domain withheld] servers (:38-57,:1-109), only on an explicit user CONNECT, and clears it on DISCONNECT. A repo-wide grep for. returns zero matches, there are no content scripts, no host_permissions, no externally_connectable, and contains no url() or @import; so there is no code path by which browsing data leaves the browser to any endpoint, and no remote-config path by which the hardcoded server list could be swapped for a hijacking PAC script (which is how most of the flagged 39% of this proxy+storage permhash cluster actually behave). The signals split: the 'malext-feed' internal note self-describes as 'not an independent code review', publisher leave-one-out history is malicious, and the chrome-stats score is demonstrably unreliable here (it cites 'permission-clipboard', which appears in neither the bundled nor the published manifest, and calls a 210-day-old extension newly created); the only corroborating signal is the generic proxy+storage permhash, which nearly every free VPN shares. Residual risk that is inherent and disclosed rather than a finding: unauthenticated SOCKS5 means the *.[domain withheld] operator can observe all proxied traffic server-side, which is the core function of the advertised product and outside the shipped code.