The code is a straightforward, unminified MV3 proxy client: sets chrome.proxy to a SOCKS5 relay on *.[domain withheld] — the manifest's own homepage_url, so the relay is first-party and routing traffic through it IS the advertised function, not exfiltration. There are no content scripts, no chrome. reads, no, and no obfuscation; the ML regex hits are trivial (innerHTML is the select.innerHTML="" clear at:332 and appendChild adds an <option> at:342), and contains only inline data-URI SVG masks. What keeps this off 'benign' is code-level, not feed-level: are plain service-worker globals (:3-4) with no restore, while chrome.proxy settings in 'regular' scope persist across the worker's idle death, so the popup reports 'Отключено' while every request still transits the operator's relay; plus deceptive packaging (20 'locations' collapse to 10 hostnames all on port 1082, 19 of 20 premium-locked into a Telegram funnel,:51 claims '25 серверов', and is a leftover mass-production template with a Windows build path and shared [domain withheld] CTA assets). Contradicting signals: the bundled manifest matches the published manifest exactly (proxy only, no mismatch), chrome-stats' 'permission-clipboard' impact reason is simply wrong since no clipboard permission exists, and the DoH A-record lookup is plausible anti-censorship engineering for a Russian-market VPN rather than evasion. Corroborating signals are weaker than they look: the malware label, the publisher's siblings and the proxy-only permhash cluster's 77% all trace to the same 2026-09-13 malext-feed import, which its own internal note states was not a code review — that is one external feed, not three independent opinions.