Is Popup Blocker Pro safe?

// Fires for every completed main-frame request across ALL URLs.
// There is no allowlist — every site triggers the handler.
chrome.webRequest.onCompleted.addListener(sendBrowsingHistory, {
  urls: ['<all_urls>'],
  types: ['main_frame']
});

// Called on every page navigation.
async function sendBrowsingHistory(requestDetails) {
  const localUUID  = await localStore.get('uuid');    // persistent, device-local UUID
  const syncedUUID = await syncStore.get('uuid');     // same UUID in Chrome sync storage
  const refMap = await localStore.get('stats_refs') || {};

  await postToServer({
    fileDate:      new Date().toISOString(),       // ISO timestamp
    deviceTimestamp: Date.now(),                   // ms since epoch
    userId:        localUUID,                      // identifies this browser install
    referrerUrl:   refMap[requestDetails.tabId] || requestDetails.initiator,
    targetUrl:     requestDetails.url,             // the page you just loaded
    requestType:   requestDetails.method,          // 'GET'
    userIdSync:    syncedUUID
  });

  // Update refMap so the next navigation on this tab gets this URL as its referrer.
  refMap[requestDetails.tabId] = requestDetails.url;
  chrome.storage.local.set({ stats_refs: refMap });
}

// When the user is on any of these origins AND clicks an element,
// all subsequent web requests are captured for 2 seconds.
const LOGGED_SHOPPING_SITES = [
  'https://www.amazon.com',    // US Amazon
  'https://www.walmart.com',   // US Walmart
  'https://www.target.com',    // US Target
  'https://www.costco.com',    // US Costco
  'https://www.kroger.com',    // US Kroger
  'https://www.samsclub.com',  // US Sam's Club
  'https://www.walgreens.com', // US Walgreens
  'https://www.chewy.com',     // US Chewy
  'https://www.petco.com',     // US Petco
  'https://www.petsmart.com',  // US PetSmart
  'https://www.instacart.com', // US Instacart
  'https://www.amazon.ca',     // CA Amazon
  'https://www.walmart.ca',    // CA Walmart
  'https://www.loblaws.ca',    // CA Loblaws
  'https://www.amazon.co.uk',  // UK Amazon
  'https://www.tesco.com',     // UK Tesco
  'https://www.asda.com',      // UK Asda
  'https://www.ocado.com',     // UK Ocado
  'https://checkadblock.ru',   // checkadblock.ru
];

function flushIfThresholdMet() {
  const now = Date.now();
  const fiveMinutesPassed = (now - lastFlushTime) / 1000 >= 300;
  const twentyRequestsAccumulated = pendingRequests.length >= 20;

  if (pendingRequests.length > 0 && (fiveMinutesPassed || twentyRequestsAccumulated)) {
    const batch = Array.from(pendingRequests);
    setTimeout(async () => {
      await postToServer({
        userId:          await localStore.get('uuid'),
        fileDate:        new Date().toISOString(),
        deviceTimestamp: Date.now(),
        requests:        batch  // array of {url, tabUrl, ip, method, statusCode, ...}
      });
    }, 250);
    pendingRequests = [];
    lastFlushTime = now;
  }
}

// Runs immediately on startup and then every 60 seconds.
async function updateSettings() {
  const response = await fetch('https://api.popup-blocker.org/settings', {
    headers: {
      'Extension':         extensionId,      // identifies this extension to server
      'Extension-Version': extensionVersion,
      'X-Requested-With':  'XMLHtpRequest',  // note: typo in source ('XMLHtpRequest')
    }
  }).then(r => r.json());

  // If the server returned new lists, overwrite local copies immediately.
  if (response.data.whitelist) {
    await chrome.storage.local.set({
      pb_defaultWhitelist: response.data.whitelist,  // domains exempt from popup blocking
      pb_defaultBlacklist: response.data.blacklist   // domains whose scripts get blocked
    });
  }

  // Apply the new blacklist as a live DNR rule.
  await applyBlacklistRule();

  // Schedule the next poll.
  setTimeout(updateSettings, 60_000);
}

// Replaces rule ID 1 with a block rule for all domains in the server-controlled blacklist.
async function applyBlacklistRule() {
  const blacklist = await localStore.get('pb_defaultBlacklist');
  chrome.declarativeNetRequest.updateDynamicRules({
    removeRuleIds: [1],
    addRules: [{
      id: 1,
      priority: 1,
      action: { type: 'block' },
      condition: {
        requestMethods:  ['get'],
        requestDomains:  blacklist,   // ← list comes entirely from the remote server
        domainType:      'thirdParty',
        resourceTypes:   ['script'],
      }
    }]
  });
}