SwitchyMalaccamax

Modern proxy switcher for Chrome — Intelligent rule-based auto-switching with security-first design.

A complete rewrite of SwitchyOmega built with TypeScript, Vue 3, and Vite. Manage multiple proxy profiles with ReDoS-safe pattern matching and AES-256-GCM credential encryption.

Features

Manual & Auto Switching — Quick profile switching or rule-based automatic routing
5 Profile Types — Direct, Fixed Server, PAC Script, Auto Switch, System Proxy
7 Condition Types — Wildcards, regex, keywords, host levels, URL patterns, bypass rules, CIDR matching
Secure Credential Storage — AES-256-GCM encryption with PBKDF2 key derivation
ReDoS Protection — All user-supplied regex patterns validated before compilation
PAC Export — Generate standards-compliant .pac files for use in browsers or proxy systems
Import/Export — Backup and restore configurations (File System Access API; no downloads permission required)

Quick Start

Installation (Users)

Download the latest release from GitHub Releases
Open Chrome and navigate to chrome://extensions/
Enable Developer mode (toggle in top-right)
Click Load unpacked
Select the dist/ folder

Development Setup

# Clone and install
git clone https://github.com/Malaccamaxgit/SwitchyMalaccamax.git
cd SwitchyMalaccamax
npm install

# Development with hot reload
npm run dev

# Build for production
npm run build

# Run tests
npm test

Usage

Click the extension icon in your toolbar to:

Switch between configured proxy profiles instantly
Access the options page for detailed configuration

Auto Switch Conditions

Auto Switch profiles evaluate requests using these matching conditions:

Type	Description	Example
Host Wildcard	Match hostnames with `*` and `?`	`*.example.com`
Host Regex	Match hostnames with regex	`^api\.example\.com$`
URL Wildcard	Match full URLs	`https://.example.com/`
URL Regex	Match full URLs with regex	`^https://.\.example\.com/.$`
Keyword	Simple substring match	`example`
Host Levels	Match by subdomain depth	Min: 2, Max: 3
Bypass	Always use direct connection	`<local>`, `127.0.0.1`

Security

This extension implements defense-in-depth security:

Feature	Implementation
ReDoS Prevention	User regex validated via `safe-regex`; catastrophic backtracking patterns rejected
Credential Encryption	AES-256-GCM with PBKDF2 (100,000 iterations); per-installation key derivation
Deterministic Matching	Wildcard matcher uses O(n+m) algorithm; no regex backtracking
Content Security Policy	Strict CSP blocks inline scripts and external resources
Input Validation	All patterns validated against complexity limits before use

See SECURITY.md for the full security policy and vulnerability reporting.

Development Commands

npm run dev          # Development mode with hot reload
npm run build        # Production build → dist/
npm test             # Run test suite (201 tests)
npm run typecheck    # TypeScript type checking
npm run lint         # ESLint
npm run format       # Prettier code formatting

Project Structure

src/
├── background/           # Service worker (proxy API, message handling)
├── popup/                # Quick switch popup UI
├── options/              # Configuration page
├── components/           # Reusable Vue components
├── core/                 # Business logic
│   ├── schema.ts         # Type definitions
│   ├── conditions.ts     # Condition matching engine
│   ├── pac/              # PAC script generation
│   └── security/         # ReDoS prevention, wildcard matcher
└── utils/                # Crypto, logging, migrations

tests/                    # Vitest test suites (201 tests)

Documentation

SECURITY.md — Security policy and vulnerability reporting
Pre-flight Checklist — Release readiness
Security Automation — Security tooling (hooks, scans)
PAC export — PAC script generation
Store permission statements — Chrome Web Store justification text
Store reviewer message — Reviewer notes template

Tech Stack

Category	Technology
Language	TypeScript 5.7 (strict mode)
Framework	Vue 3 Composition API
Build Tool	Vite 6 + @crxjs/vite-plugin
Test Runner	Vitest (201 tests)
CSS	Tailwind CSS
Crypto	Web Crypto API (AES-GCM, PBKDF2)
Target	Chrome Manifest V3

License

GNU General Public License v3.0 — see LICENSE for details.

Issues: GitHub Issues Discussions: GitHub Discussions

This site is open source. Improve this page.