The extension code is clean, readable, and does exactly what it claims — it configures a SOCKS5 proxy via chrome.proxy with hardcoded server IPs and [domain withheld] subdomains, with no obfuscation, no data exfiltration, and no code injection. However, the publisher operates under at least four distinct brand identities (Urban VPN, Муха VPN referenced in:79, VPN Shadow in the publisher-level privacy policy URL, and [domain withheld] opened on install), suggesting a rebrand factory pattern. The on-install redirect to [domain withheld] (:255) is a concrete concern: it opens a tab to a domain not disclosed in the CWS listing, the privacy policy, or the extension homepage, consistent with install-tracking or affiliate harvesting. The ML score (0.13 flagged 'high') is driven mainly by the proxy permission and small file count — not by code patterns — and the permhash cluster's 6% malware rate mildly corroborates concern but is not itself decisive. Third-party checker's clipboard flag is spurious; no clipboard permission exists in the manifest.