User clicks the extension icon → popup opens → extension reads the current tab URL via chrome.tabs API → generates and displays a QR code encoding that URL → user can scan the QR code with a mobile device or download it. Note: the extension also bundles suspicious fingerprinting (FingerprintJS) and ad-blocker detection code injected into every page via content scripts, which goes well beyond the stated QR code functionality.

Target users: General web users who need to quickly share page URLs via QR codes / Developers and productivity-focused users

The source code is heavily minified making deep inspection of the popup.js logic difficult
js/contentscript.js and js/components.js contain embedded FingerprintJS (browser fingerprinting library) and ad-blocker filter lists, which is highly suspicious for a simple QR code extension — the actual purpose of this injected code is unclear and potentially malicious
Could not fully verify if the fingerprinting data is sent to rsapi.qentifyrs.com or other external hosts

Monetization

No paid features detected

The static scan keyword hits for 'subscribe', 'paywall', 'pro', and 'license' are all false positives from embedded libraries (FingerprintJS, React, qrcode.react, ad-blocker filter lists). The 'subscribe' and 'paywall' strings are CSS selectors used in ad-blocker filter lists embedded in js/components.js and js/contentscript.js (e.g., fanboyAnnoyances list containing '[title="Subscribe to our blog"]' and fanboyEnhancedTrackers containing '#issuem-leaky-paywall-articles-zero-remaining-nag'). The 'license' matches are open-source license headers (MIT, ISC). No Stripe, payment API, pricing UI, subscription gate, upgrade prompt, or billing integration was found. No chrome.inAppPayments or web store purchase API usage detected.

Confidence: 85
Payment platform: --
Source: AI / Medium
Login required: No
Reason: No login, account, or authentication flow found in the extension. The extension is a standalone QR code generator that works directly from the browser popup with no account creation or sign-in step. The 'auth' match in manifest.json is a false positive (the word 'author'). The 'session' matches in components.js and contentscript.js are from the embedded FingerprintJS library, not login session management.

Permission risk

High-risk permissions

This estimate uses declared permissions and host permissions to assess access scope and sensitivity.

扩展能力较强：storage、tabs
主机权限覆盖范围较宽

Publisher

nslirui8

Independent publisher

Email: [email protected]
Phone: --
Address: --

Public contact fields are shown above. Developer portfolio pages are available on paid accounts.

View developer portfolio

Permissions

Host access