Is Who Unfollowed Me? safe?

Medium risk

Who Unfollowed Me is medium risk. Entering an email in the license form makes Who Unfollowed Me? send it to www.invertexto.com as part of a license-check URL. The store listing describes comparing follower lists; it doesn't mention this email transmission.

invertexto.comv1.2.6Chrome Web Store
45Risk
Who publishes it

invertexto.com - 6 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
invertexto.com

Same store account

6 other listings published from this account, 1.1M+ users between them. 1 of them carries a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

License Check Sends Your Email to Invertexto

Entering an email in the license form makes Who Unfollowed Me? send it to www.invertexto.com as part of a license-check URL.

The store listing describes comparing follower lists; it doesn't mention this email transmission.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You submit an email address in the extension's license form.

The form appears on the extension's license page and is wired to the Enter button.

The extension did this

The extension sends that email address to Invertexto's license-check endpoint.

Observed dynamic-analysis evidence records the GET request path and source code shows the email value is appended as the `email` query parameter.

02EvidenceFIELD TABLE
Fields carried by the license-check flow
FieldValueWhy it matters
Your license email
user@example.com (illustrative)This can identify the person or account being checked for license status.
Product being checked
unfollowedThis tells the receiving service which extension product the email is being checked against.
Stored license result
email=user@example.com, expiration=2026-12-31 (illustrative)If the server reports an active license, the extension keeps the email and expiration date in browser storage.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.invertexto.com/licenses/check.php?product=unfollowed&email=user@example.com
The extension expects a JSON response with status and expiration fields.
04EvidenceCODE COMPARE
The code that does this

The license button reads the form field and builds the request URL

What it actually does
Readable license flowdeobfuscated/license.js
let enterButton = document.getElementById("enter"),
  licenseDiv = document.getElementById("license-info"),
  emailInput = document.getElementById("email");
emailInput.setAttribute("placeholder", chrome.i18n.getMessage("licensePlaceholder")), document.querySelectorAll("[data-locale]").forEach(a => {
  a.innerHTML = chrome.i18n.getMessage(a.dataset.locale)
});

function activeLicenseHtml(a) {
  return chrome.i18n.getMessage("licenseActive") + ": " + a.email + "<br>" + chrome.i18n.getMessage("licenseExpiration") + ": " + a.expiration
}
chrome.storage.local.get(["license"]).then(a => {
  a.license !== void 0 && (licenseDiv.innerHTML = activeLicenseHtml(a.license))
}), enterButton.addEventListener("click", function() {
  let a = emailInput.value;
  return a ? void fetch("https://www.invertexto.com/licenses/check.php?product=unfollowed&email=" + a).then(a => a.json()).then(b => {
    if ("ok" != b.status) return alert(b.status);
    const c = {
      email: a,
      expiration: b.expiration
    };
    chrome.storage.local.set({
      license: c
    }, () => {
      licenseDiv.innerHTML = activeLicenseHtml(c)
    })
  }).catch(() => {
    alert(chrome.i18n.getMessage("unexpectedError"))
  }) : alert(chrome.i18n.getMessage("licenseEnterAlert"))
});
05EvidenceTHIRD PARTY LIST
External destination used by this claim
  • www.invertexto.com

    Receives the license-check GET request with product=unfollowed and the email query parameter; the same domain is listed as the extension author site.

Updated 30 September 2026fgeghoapchhdkpflicgicmiabmpeklkn