What our analysis found

Дед ВПН - Работает в РФ, обход блокировок сайтов и YouTube, used by 1,000 people, showed no malicious code in Extension Auditor's review. It comes from a publisher with 13 extensions and was last updated in July 2026.

The entire extension is a 5-file, ~10KB proxy toggle::24-49 sets one fixed HTTPS proxy (, the same domain as PREMIUM_LINK) via chrome.proxy,:51-63 clears it, and renders a static location list — there are no content scripts, no host_permissions, no webRequest, and no call anywhere in the bundle, so nothing reads page content, history, cookies or the clipboard. The signed lists exactly 12 files (3 JS, 1 HTML, 1 CSS, manifest, 6 PNGs), all present, so coverage is complete; the bundled manifest also matches the published manifest (proxy, storage) with no mismatch. Contradicting the 0.92 ML score: the publisher is malicious, the chrome-stats reason cites a clipboard permission neither manifest requests, and the internal 'malware' label is a 2026-09-13 feed import explicitly self-described as 'not an independent code review'. Residual risk that keeps this off false_positive is contextual, not code-level: an anonymous operator (gmail author, privacy policy, 'VeePN' in the description, publisher policy titled 'Browsec VPN') necessarily receives all proxied traffic while declaring no data collection — brand-confusing and untrustworthy, but the traffic routing is the extension's stated and only function.