The code is small, unobfuscated and does exactly what the listing claims: sets chrome.proxy.settings to a fixed SOCKS5 node and renders a popup — there is no telemetry, no content script, no remote code loading, no access, and the bundled manifest matches the published manifest exactly (manifest_version 3, permissions: ["proxy"]). The one code-specific defect is a state desync: connection state lives only in the MV3 service-worker globals (:3-4), there is no storage permission and no chrome.proxy.settings.get anywhere in the bundle, yet the proxy setting is written with scope "regular" and persists across restarts — so after the worker is evicted the popup reports "off" (RELAY_POLL,:241-245) while all traffic still exits through; intent is unprovable, which is why this is suspicious rather than malicious. Corroborating context (publisher malicious, 77% of the 1026-member permhash cluster flagged, chrome-stats likelihood) is weak and likely circular here: this extension's own label comes from the malext feed import, which the internal note itself describes as not an independent code review, and the chrome-stats "permission-clipboard" reason is simply wrong — no clipboard permission or clipboard API appears anywhere in the bundle. Secondary code-level oddities: the free tier is an unauthenticated SOCKS5 endpoint on a bare IP operated by an undisclosed party while CWS data collection is "none declared" (the proxy necessarily sees every destination hostname, since Chrome resolves DNS remotely over socks5); the premium funnel in:195-197 points at [domain withheld] / [domain withheld] with tracked ref UUIDs, a different brand from the manifest's homepage_url [domain withheld]; and:30 advertises "25 серверов" while the arrays list 20. Note the bundle supplied only 5 files — the assets/ directory (icons,,) referenced by the manifest and popup was not provided, so those were not reviewed, though SVGs loaded via <img> cannot execute script.