The extension does exactly one thing: on an explicit popup click it sets `chrome.proxy.settings` to a hardcoded SOCKS5 server and clears it on stop (:194-244). There are no content scripts, no host permissions, no, no obfuscation, no remote code, and the single network call is a data-less HEAD to the proxy port for latency display (:17); contains no url()/@ references at all. Contradicting signals: the malext feed 'malware' label is a bulk import, not a code review, and is unsupported by anything in these 5 JS files; chrome-stats' top impact reason is 'permission-clipboard', which the manifest flatly contradicts (only `proxy` is declared, and the bundled manifest matches the published one exactly); the publisher is malicious. Corroborating caution, kept out of findings: server state lives only in service-worker memory (:191-192) with no `chrome.proxy.settings.get`, no onStartup handler and no storage permission, so after the worker idles or the browser restarts all traffic keeps flowing to while the popup reads 'Не защищено' and the Stop path is unreachable — a classic MV3 lifecycle bug rather than demonstrable intent, and the real risk here (what the proxy operator does with the traffic) is not observable from the bundle.