The bundle is 6 small, unobfuscated code files (13 files in the signed, all non-image ones present, so nothing is truncated) implementing exactly one behaviour::26-38 sets chrome.proxy to mode 'fixed_servers' pointing at [domain withheld] with bypassList ['<local>'], toggled from. There is no anywhere, no, no content scripts, no host_permissions, no webRequest and no cookie access, and the bundled manifest matches the published manifest exactly - so the 0.90 ML score is not corroborated by code (js_innerhtml:1 is:107 clearing a list with innerHTML=''; the remaining features are plain structural file counts), and chrome-stats' 'permission-clipboard' impact reason is flatly contradicted by a manifest holding only proxy+storage. What keeps this above benign is identity, not an unauthorised sink: the brand themselves 'Urban Vpn' (:2,:6) while:6 advertises 'Troywell VPN' - two real, unrelated commercial VPN brands in one package - the traffic goes to an unbranded.space host matching neither, both privacy policies live on anonymous paste sites ([domain withheld], [domain withheld]) under a gmail author, carries a large unused multi-variant skin template ( rings for a popup that only uses --vcap) plus a theme mismatch (THEME 'urban-acid' vs class 'theme-urban-metro') that reads as mass-produced clone scaffolding, and all browser traffic is placed in the custody of that anonymous operator while CWS data collection is declared 'none'. I deliberately discount the publisher's malicious count and the internal note as a single non-independent signal: both originate from the same 2026-09-13 malext feed import, not from code review.