Every line of the extension is accounted for and does exactly what a minimal free-VPN shell should::24-49 sets chrome.proxy to fixed_servers pointing at [domain withheld],:51-63 clears it, storage holds a single boolean, and is pure DOM rendering of a toggle plus a premium upsell. There is no fetch, XMLHttpRequest, eval, Function(), atob, chrome.tabs, cookie or clipboard access anywhere in the three JS files, so no code-level exfiltration, injection or remote-code path exists; the proxy host is a subdomain of [domain withheld], the same domain as:11 PREMIUM_LINK, i.e. first-party for a VPN, which is rule-8 core function. Contradicting the ML score: the bundle is complete (ML total_file_count 14 minus image_file_count 7 = the 7 non-image files present) and the regex hits resolve to benign constructs. Raising contextual (not code) risk, stated here rather than as findings: the publisher is flagged on other extensions, 38% of the 1114-member permhash cluster is flagged, the privacy policy is a [domain withheld] pastebin, the listing declares no data collection while proxying all traffic, 259 reviews against 229 users suggests review inflation, and the stuff two unrelated brands (Hola VPN, Turbo VPN); residual abuse would be entirely server-side at the proxy operator and is not auditable from this code. The chrome-stats score does not corroborate anything here — it cites permission-clipboard, which this manifest does not request, and creation-recent-month against a 91-day age, so it is a stale snapshot.