Is Netflix Skipper: skip intros, recaps & more [QVI] safe?

Medium risk

Netflix Skipper collects Netflix account details, viewing history, and profile data and transmits them to remote servers on a 30-minute cycle.

The extension runs a server-directed scraping pipeline that queries Netflix internal APIs for profiles, viewing history, device lists, and watchlists, then uploads the results to me3x.online. Separately, it reads account owner PII — including name, email addresses, country, and account GUIDs — from Netflix's page state and sends them to metricsmint.quest. Both pipelines run in the background and repeat every 30 minutes regardless of user interaction.

dogooodappv1.2.12Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Netflix helper sends install ID and error context to me3x.online on page load

Though scoped to Netflix, the background worker loads a bundled logger (typ.min.js) reporting to me3x.online.

A Netflix visit produced a POST to me3x.online/n/js/dlog with the runtime ID, a per-install UUID, version, and error text.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a Netflix page with the extension installed.

The extension's content script and background service worker are scoped to netflix.com and the other Netflix country domains listed in the manifest.

The extension did this

The background service worker loads a bundled logging component that reports back to me3x.online.

On the page's error path the component sends a POST to https://me3x.online/n/js/dlog containing the extension runtime ID, a per-install UUID, the version, and the error message.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://me3x.online/n/js/dlog
Observed during dynamic analysis on navigation to www.netflix.com: a 312-byte JSON POST, preceded by a CORS preflight, was sent on the page's getRequest error path. The dist field carries the extension runtime ID observed in that session; extensionUserId is a UUID generated and stored per install.
Headers
Content-Typeapplication/json
Body
{
  "dist": "hkkonihelbmcdiikfebpdoiihdgpclik",
  "revision": "ead0d9e8",
  "platform": "netflix",
  "namespace": "getRequest response error",
  "extVer": "1.2.12",
  "extensionUserId": "fed67abc-6447-4f1d-8f00-4b897dab134f",
  "dhVer": "<build>",
  "message": "<error stack>"
}
03EvidenceFIELD TABLE
Fields in the me3x.online/n/js/dlog report
FieldValueWhy it matters
Extension install ID
hkkonihelbmcdiikfebpdoiihdgpclikThe extension's runtime ID, which is stable for a given installation and lets the server tie reports to a specific install.
Per-install user ID
fed67abc-6447-4f1d-8f00-4b897dab134fA UUID the extension generates once and keeps in storage; it persists across sessions and links every report from the same installation.
Platform
netflixWhich site context produced the report. Here it is fixed to Netflix.
Extension version
1.2.12The installed version of the extension.
Namespace / error message
getRequest response errorA label and the text of the internal error or exception that triggered the report.
Build revision
ead0d9e8A fixed build identifier baked into the extension's logging config.
04EvidenceCODE COMPARE
The code that does this

The bundled logger and its me3x.online destination

What it actually does
What each report containstyp.min.js
logData = {
  dist: getDist(),                 // chrome.runtime.id
  revision: revision,              // 'ead0d9e8'
  platform: platform,              // 'netflix'
  namespace: namespace,            // e.g. 'getRequest response error'
  extVer: getExtensionVersion(),   // '1.2.12'
  extensionUserId: extensionUserId,// per-install UUID from chrome.storage
  dhVer: package_namespaceObject.rE,
  message: `${message}`            // error / stack text
};
await httpNodeLog(logData);        // POST https://me3x.online/n/js/dlog
05EvidenceTHIRD PARTY LIST
Where the report is sent
  • me3x.online

    Receives logging POSTs at /n/js/dlog: runtime ID, per-install UUID, version and error context. Not Netflix, and not a named first-party analytics service in the listing.

Data recipients

me3x.onlinemetricsmint.quest
Updated 17 September 2026oabcpbggaldpjflfnaoaghfgohnnonca