Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: QRCodeTool

CRITICAL RISKRemoved from Chrome Web Store

QRCodeTool

ID: ohmipfekaanefeilclgkbjhhidedjoop

Could be malicious

Supported Languages

🇪🇹Amharic

🇸🇦Arabic

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇱Hebrew

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇮🇳Kannada

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇮🇷Persian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇰🇪Swahili

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.1

Size

0.16 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Aug 19, 2025

Publisher Contextual Analysis

Author: echoniu104View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

321

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Convert webpages into QR codes for easy sharing

QRCodeTool is an indispensable QR code efficiency tool for your web browsing. It perfectly integrates the two core functions of QR code generation and recognition, aiming to solve all the pain points of interacting with QR codes on your computer. Core functions: One-click generation of the QR code of the current page Just click the extension icon on the browser toolbar, and a clear QR code will be immediately generated for the URL of the web page you are browsing. No need for any extra operations, it is very suitable for quickly sharing long links, articles, or any web content to your mobile phone for reading or testing. Right-click to identify the QR code in the web page See a QR code of interest on the web page? Say goodbye to the tedious steps of taking out your phone to scan the computer screen! Now, you can just move your mouse to any QR code image, right-click, and select "Recognize QR Code" in the menu to immediately see the text, link or other information contained in it. Preview the content of unknown links before clicking them to make your web browsing safer.

User Growth

Showing data from Aug 20, 2025 to Aug 02, 2026

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1 Code review	7

Extension Version	Code Review Findings
1.1	7

Files with findings

4 distinct paths — top paths by unique finding count:

nbsdk/nbsdk.js3
nbsdk/payment/reward.js2
nbsdk/login/login.js1
nbsdk/payment/payment.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	nbsdk/payment/payment.js (line 20)	Fetches arbitrary HTML from the remote server pay.extensiondata.com and replaces the entire document via document.documentElement.innerHTML, which injects server-controlled markup and re-executes bundled SDK scripts a…	1.1
2	Remote Code Loading	critical	nbsdk/payment/reward.js (line 21)	Identical pattern to payment.js: pulls a full HTML document from pay.extensiondata.com and swaps it into the page with innerHTML, effectively granting the remote server the ability to inject arbitrary scripts and DOM …	1.1
3	Credential Theft	high	nbsdk/nbsdk.js (line 19)	OAuth redirect_uri points at an arbitrary Cloudflare Workers subdomain (rapid-waterfall-273a.chromeextensions.workers.dev) rather than a verified extension origin. This routes the user's Google OAuth code through an a…	1.1
4	Credential Theft	high	nbsdk/login/login.js (line 28)	For a QR-code utility that needs no account, the extension forces a full Google OAuth flow with offline access (refresh token) to userinfo.email and userinfo.profile, delivering the authorization code to a third-party…	1.1
5	Obfuscation	high	nbsdk/nbsdk.js (line 182)	The entire monetization/login/remote-HTML pipeline is disabled for browsers whose UI language is zh-CN, meaning Chinese users (and likely Chinese Web Store reviewers) never see the payment, OAuth, or remote HTML injec…	1.1
6	Unauthorized Data Collection	high	nbsdk/nbsdk.js (line 193)	Uses chrome.tabs.onUpdated to watch every navigation for URLs that contain the server's endpoints, then scrapes email (mail) and other identifiers out of those URLs and persists them into extension storage. Combined w…	1.1
7	Other	medium	nbsdk/payment/reward.js (line 52)	The extension checks whether the user's account name appears in the store reviews page the server returns, and only grants a free trial if it finds their name — a coercive review-for-reward scheme that manipulates Chr…	1.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/cozmo/jsQR	https://github.com/cozmo/jsQR
www.google.com	/favicon.ico	https://www.google.com/favicon.ico
accounts.google.com	/o/oauth2/v2/auth	https://accounts.google.com/o/oauth2/v2/auth?scope=https%3A//www.googleapis.com/auth/userinfo.profile+https%3A//www.googleapis.com/auth/userinfo.email&access_type=offline&include_granted_scopes=true&response_type=code&client_id=${sdkOauth2.client_id}&state=${sdk_appid(
pay.extensiondata.com	-	https://pay.extensiondata.com
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

QRCodeTool

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating