Is Netflix Skipper: skip intros, recaps & more [QVI] safe?
Netflix Skipper collects Netflix account details, viewing history, and profile data and transmits them to remote servers on a 30-minute cycle.
The extension runs a server-directed scraping pipeline that queries Netflix internal APIs for profiles, viewing history, device lists, and watchlists, then uploads the results to me3x.online. Separately, it reads account owner PII — including name, email addresses, country, and account GUIDs — from Netflix's page state and sends them to metricsmint.quest. Both pipelines run in the background and repeat every 30 minutes regardless of user interaction.
Who publishes itHideApp - 96 other listings from the same operator, 14 of them carrying a finding
HideApp - 96 other listings from the same operator, 14 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
40 other listings published from this account, 265k+ users between them. 2 of them carry a finding.
Same operator - 56 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Netflix helper sends install ID and error context to me3x.online on page load
Though scoped to Netflix, the background worker loads a bundled logger (typ.min.js) reporting to me3x.online.
A Netflix visit produced a POST to me3x.online/n/js/dlog with the runtime ID, a per-install UUID, version, and error text.
What actually happens
You open a Netflix page with the extension installed.
The extension's content script and background service worker are scoped to netflix.com and the other Netflix country domains listed in the manifest.
The background service worker loads a bundled logging component that reports back to me3x.online.
On the page's error path the component sends a POST to https://me3x.online/n/js/dlog containing the extension runtime ID, a per-install UUID, the version, and the error message.
Captured request
Observed during dynamic analysis on navigation to www.netflix.com: a 312-byte JSON POST, preceded by a CORS preflight, was sent on the page's getRequest error path. The dist field carries the extension runtime ID observed in that session; extensionUserId is a UUID generated and stored per install.
- Content-Type
- application/json
{ "dist": "hkkonihelbmcdiikfebpdoiihdgpclik", "revision": "ead0d9e8", "platform": "netflix", "namespace": "getRequest response error", "extVer": "1.2.12", "extensionUserId": "fed67abc-6447-4f1d-8f00-4b897dab134f", "dhVer": "<build>", "message": "<error stack>"}Fields in the me3x.online/n/js/dlog report
- Extension install IDhkkonihelbmcdiikfebpdoiihdgpclik
The extension's runtime ID, which is stable for a given installation and lets the server tie reports to a specific install.
- Per-install user IDfed67abc-6447-4f1d-8f00-4b897dab134f
A UUID the extension generates once and keeps in storage; it persists across sessions and links every report from the same installation.
- Platformnetflix
Which site context produced the report. Here it is fixed to Netflix.
- Extension version1.2.12
The installed version of the extension.
- Namespace / error messagegetRequest response error
A label and the text of the internal error or exception that triggered the report.
- Build revisionead0d9e8
A fixed build identifier baked into the extension's logging config.
The code that does this
The bundled logger and its me3x.online destination
What each report contains
typ.min.jslogData = { dist: getDist(), // chrome.runtime.id revision: revision, // 'ead0d9e8' platform: platform, // 'netflix' namespace: namespace, // e.g. 'getRequest response error' extVer: getExtensionVersion(), // '1.2.12' extensionUserId: extensionUserId,// per-install UUID from chrome.storage dhVer: package_namespaceObject.rE, message: `${message}` // error / stack text};await httpNodeLog(logData); // POST https://me3x.online/n/js/dlogWhere the report is sent
- me3x.online
Receives logging POSTs at /n/js/dlog: runtime ID, per-install UUID, version and error context. Not Netflix, and not a named first-party analytics service in the listing.
Where it sends data
Destinations our analysis observed Netflix Skipper: skip intros, recaps & more [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- metricsmint.questwidely used
Netflix Skipper: skip intros, recaps & more [QVI] sends data to metricsmint.quest. A widely used service: 60 other extensions we have analyzed send data here.
- me3x.onlinewidely used
Netflix Skipper: skip intros, recaps & more [QVI] sends data to me3x.online. A widely used service: 58 other extensions we have analyzed send data here.