Is APK Downloader safe?

const config = { run_at: "document_start" };

// Runs immediately when the content script loads on ANY page.
async function reportPageInfo() {
  chrome.runtime.sendMessage(buildPkgInfoMessage());
}

function buildPkgInfoMessage() {
  return {
    type: messageType.pkgInfo,
    data: extractProductDataFromDOM()
  };
}

function extractProductDataFromDOM() {
  // Look for schema.org itemprop="offers" elements
  const offersEls = document.querySelectorAll('[itemprop="offers"]');

  let extracted = {};
  const itempropEls = document.querySelectorAll('[itemprop]');
  const jsonLdEls = document.querySelectorAll('[type="application/ld+json"]');
  const wantedFields = ['image', 'name', 'priceCurrency', 'price', 'ratingValue', 'ratingCount', 'publisher', 'worstRating', 'bestRating'];
  const productTypes = ['MobileApplication', 'SoftwareApplication', 'Product', /* schema.org variants */];

  // Try JSON-LD structured data first (runs on EVERY page with a matching <script type="application/ld+json">)
  try {
    jsonLdEls.forEach(el => {
      const data = JSON.parse(el.innerText);
      // ...matches against productTypes and captures the object into `extracted`
    });
  } catch (e) {}

  // Fall back to itemprop microdata attributes if no JSON-LD matched
  if (itempropEls.length && !Object.keys(extracted).length) {
    itempropEls.forEach(el => {
      wantedFields.forEach(field => {
        if (el.getAttribute('itemprop') === field) {
          extracted[field] = el.content || el.src || el.innerText;
        }
      });
    });
  }

  // Per-site adjustments for ~23 known app-store domains (Google Play, App Store, APKPure, etc.)
  // ...

  return {
    url: extracted.url,
    domain: window.location.hostname,   // sent for EVERY page, whitelisted or not
    packageId: extracted.packageId,
    icon: extracted.image,
    title: extracted.name,
    priceCurrency: extracted.priceCurrency,
    price: extracted.price,
    developer: extracted.publisher,
    ratingValue: extracted.ratingValue,
    reviewCount: extracted.ratingCount,
    worstRating: extracted.worstRating,
    bestRating: extracted.bestRating
  };
}

// Fires once on script load, and again on every SPA navigation.
reportPageInfo();
chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
  if (msg.type === messageType.getPkg) sendResponse(buildPkgInfoMessage());
});
window.addEventListener('hashchange', reportPageInfo);
window.addEventListener('pushState', reportPageInfo);
window.addEventListener('popstate', reportPageInfo);

// Called for every pkgInfo message received from the content script, on every page.
function handlePkgInfo(message, tabId) {
  const isWhitelistedDomain = schemaWhiteUrlList.some(host => message.data.domain === host);

  // Record whether this page's domain was on the app-store whitelist — for EVERY page.
  chrome.storage.local.set({ isWhiteUrl: isWhitelistedDomain });

  if (!isWhitelistedDomain) {
    clearBadge(tabId);
    return; // extracted data is discarded here, not persisted
  }

  setBadge(tabId, message.data.title ? '1' : '');
  chrome.storage.local.set({
    data: message.data.title ? JSON.stringify(message.data) : null,
    tabId: tabId
  });
}

chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  if (message?.type === messageType.pkgInfo) {
    handlePkgInfo(message, sender?.tab?.id);
  }
});

// Called by background onMessage handler whenever popup sends a 'report' message.
async function reportAtta(eventCode, extraInfo = {}) {
 // Read the persistent device UUID from storage (creates one on first run).
 let { 'apk-downloader-uid': clientId } = await chrome.storage.local.get('apk-downloader-uid');
 if (!clientId) {
 clientId = nanoid; // generates a URL-safe random 21-char ID
 await chrome.storage.local.set({ 'apk-downloader-uid': clientId });
 }

 // Build the query string and fire the GET beacon.
 const params = new URLSearchParams({
 atta_id: '05200075581', // hardcoded partner ID
 random: Math.random.toString, // cache-busting noise
 client_id: clientId, // persistent per-device UUID
 event_code: eventCode, // 'open' | 'search' | 'download' | 'install'
 ...extraInfo // includes { url: <current_tab_url> }
 });
 await fetch(`https://tapi.pureapk.com/report/search_report?${params}`);
}

// Runs once when the popup loads.
useEffect(async => {
 const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
 if (!tab) return;

 // Send 'open' event to background with the current tab's URL.
 chrome.runtime.sendMessage({
 type: 'report',
 data: {
 eventCode: 'open',
 extraInfo: { url: tab.url || '' }
 }
 });

 // ... then fetch APK info for the page
}, []);