Modern proxy switcher for Chrome — Intelligent rule-based auto-switching with security-first design.
A complete rewrite of SwitchyOmega built with TypeScript, Vue 3, and Vite. Manage multiple proxy profiles with ReDoS-safe pattern matching and AES-256-GCM credential encryption.
- Manual & Auto Switching — Quick profile switching or rule-based automatic routing
- 5 Profile Types — Direct, Fixed Server, PAC Script, Auto Switch, System Proxy
- 7 Condition Types — Wildcards, regex, keywords, host levels, URL patterns, bypass rules, CIDR matching
- Secure Credential Storage — AES-256-GCM encryption with PBKDF2 key derivation
- ReDoS Protection — All user-supplied regex patterns validated before compilation
- PAC Export — Generate standards-compliant
.pacfiles for use in browsers or proxy systems - Import/Export — Backup and restore configurations (File System Access API; no
downloadspermission required)
- Download the latest release from GitHub Releases
- Open Chrome and navigate to
chrome://extensions/ - Enable Developer mode (toggle in top-right)
- Click Load unpacked
- Select the
dist/folder
# Clone and install
git clone https://github.com/Malaccamaxgit/SwitchyMalaccamax.git
cd SwitchyMalaccamax
npm install
# Development with hot reload
npm run dev
# Build for production
npm run build
# Run tests
npm testClick the extension icon in your toolbar to:
- Switch between configured proxy profiles instantly
- Access the options page for detailed configuration
Auto Switch profiles evaluate requests using these matching conditions:
| Type | Description | Example |
|---|---|---|
| Host Wildcard | Match hostnames with * and ? |
*.example.com |
| Host Regex | Match hostnames with regex | ^api\.example\.com$ |
| URL Wildcard | Match full URLs | https://*.example.com/* |
| URL Regex | Match full URLs with regex | ^https://.*\.example\.com/.*$ |
| Keyword | Simple substring match | example |
| Host Levels | Match by subdomain depth | Min: 2, Max: 3 |
| Bypass | Always use direct connection | <local>, 127.0.0.1 |
This extension implements defense-in-depth security:
| Feature | Implementation |
|---|---|
| ReDoS Prevention | User regex validated via safe-regex; catastrophic backtracking patterns rejected |
| Credential Encryption | AES-256-GCM with PBKDF2 (100,000 iterations); per-installation key derivation |
| Deterministic Matching | Wildcard matcher uses O(n+m) algorithm; no regex backtracking |
| Content Security Policy | Strict CSP blocks inline scripts and external resources |
| Input Validation | All patterns validated against complexity limits before use |
See SECURITY.md for the full security policy and vulnerability reporting.
npm run dev # Development mode with hot reload
npm run build # Production build → dist/
npm test # Run test suite (201 tests)
npm run typecheck # TypeScript type checking
npm run lint # ESLint
npm run format # Prettier code formattingsrc/
├── background/ # Service worker (proxy API, message handling)
├── popup/ # Quick switch popup UI
├── options/ # Configuration page
├── components/ # Reusable Vue components
├── core/ # Business logic
│ ├── schema.ts # Type definitions
│ ├── conditions.ts # Condition matching engine
│ ├── pac/ # PAC script generation
│ └── security/ # ReDoS prevention, wildcard matcher
└── utils/ # Crypto, logging, migrations
tests/ # Vitest test suites (201 tests)
- SECURITY.md — Security policy and vulnerability reporting
- Pre-flight Checklist — Release readiness
- Security Automation — Security tooling (hooks, scans)
- PAC export — PAC script generation
- Store permission statements — Chrome Web Store justification text
- Store reviewer message — Reviewer notes template
| Category | Technology |
|---|---|
| Language | TypeScript 5.7 (strict mode) |
| Framework | Vue 3 Composition API |
| Build Tool | Vite 6 + @crxjs/vite-plugin |
| Test Runner | Vitest (201 tests) |
| CSS | Tailwind CSS |
| Crypto | Web Crypto API (AES-GCM, PBKDF2) |
| Target | Chrome Manifest V3 |
GNU General Public License v3.0 — see LICENSE for details.
Issues: GitHub Issues Discussions: GitHub Discussions