Is Hola VPN - Your Website Unblocker safe?

// Chrome_headers: captures Chrome identity headers from Google requests without a consent prompt
class Chrome_headers {
  constructor(conf) {
    this.conf = conf;
    this.data = {};   // accumulates captured headers between flushes
    this.listener = this._listener.bind(this);
  }

  // Called by A/B gate when test_send_chrome_headers value = 'on'
  activate() {
    chrome.webRequest.onSendHeaders.addListener(
      this.listener,
      { urls: ['*://*.google.com/*'] },
      // 'extraHeaders' is required to access privileged Chrome-internal headers
      // (X-Client-Data is not accessible to extensions without this flag)
      ['requestHeaders', 'extraHeaders']
    );
  }

  deactivate() {
    try { chrome.webRequest.onSendHeaders.removeListener(this.listener); }
    catch (e) { /* ignore */ }
  }

  // Generator: POSTs accumulated headers to Hola backend every ~10 min
  *_send() {
    yield be_bg_ajax.ccgi_ajax({
      url: conf.url_ccgi + '/chrome_headers?be_ver=' + version(),
      method: 'POST',
      data: this.data  // { 'X-Client-Data': 'CJOHywE=', 'User-Agent': '...', ... }
    });
  }
}

const chrome_header_names = ["x-browser-channel", "x-browser-copyright", "x-browser-validation", "x-browser-year", "x-client-data", "user-agent"];
const google_url_pattern = "*://*.google.com/*";

// _add_listener(): capture matching headers off every outgoing Google request
this.listener = details => {
  if (!details.requestHeaders) return;
  const headers = {};
  for (const hdr of details.requestHeaders) {
    if (chrome_header_names.includes(hdr.name.toLowerCase())) {
      headers[hdr.name] = hdr.value;
    }
  }
  if (!Object.keys(headers).length) return;
  if (ua_full_ver) {
    const ua_str = headers["User-Agent"] || headers["user-agent"] || "";
    if (ua_str) headers["User-Agent"] = ua_str.replace(/Chrome\/[\d.]+/, "Chrome/" + ua_full_ver);
  }
  this.data = headers;
  this.send();
};
self.chrome.webRequest.onSendHeaders.addListener(
  this.listener,
  { urls: [google_url_pattern] },
  ["requestHeaders", "extraHeaders"]
);

// send(): POST the captured headers to the Hola endpoint
yield E.be_bg_ajax.ccgi_ajax({
  url: conf.url_ccgi + "/chrome_headers?be_ver=" + version(),
  method: "POST",
  data: this.data,
  timeout: 10 * ms.SEC
});

// default extension config: collection wiring is present and enabled...
collect_chrome_headers: { enabled: true, interval: 6e5 },  // 600,000 ms = 10 min

// ...but a server-controlled A/B test decides who actually runs it:
test_send_chrome_headers: {
  ver: 2,
  min_ver: "1.251.527",
  value: [[0, 1, "off"], [0, 0, "on"]],
  filter: { browser: "chrome" }
}

// gate at update_config():
if (ch_ab.test_send_chrome_headers != "on") ch_conf.enabled = false;

// js/bg.bg.bundle.js (zurl module), line ~54857
E.bvpn_domains = [
  "bright-sdk.com", "brightvpn.com", "earnapp.com", "brightvideo.tv",
  "bright4good.eco", "thepiggybox.net", "freemovielibrary.tv",
  "rewardgum.com", "boostnet.info", "screensavers.app"
];

function init_hola_domains_re() {
  // bvpn_domains are concatenated alongside Hola's own infrastructure domains.
  var domains = E.hola_domains
    .concat(additional_domains)
    .concat(E.hola_browser_internal_domains)
    .concat(E.hola_ext_domains)
    .concat(E.bvpn_domains);          // <-- the new Bright Data list
  return domains_re(domains);
}
var hola_domain_re = init_hola_domains_re();

E.is_hola_domain = function(domain) {
  return E.is_valid_domain(domain) && domain.search(hola_domain_re) != -1;
};

// js/bg.bg.bundle.js, is_vpn_allowed, line ~36527
if (is_all_browser_rule_active() || is_debug_peer_rule_active()) {
  return !bg_util.is_private_network(hostname, browser.isInNet)
      && !unblocker_lib.is_agent(hostname)
      && !/zagent\d+\.hola\.org/.test(hostname)
      && (is_debug_peer_rule_active() || !zurl.is_hola_domain(hostname));
  // is_hola_domain(hostname) === true  =>  returns false  =>  DIRECT (no VPN)
}