I built a QR code phishing scanner for our free API — and ended up writing a PNG decoder from scratch to make it work.

**

The problem

QR code phishing ("quishing") is one of the fastest-growing phishing vectors right now — Microsoft's 2026 report puts the year-over-year growth at 146% in Q1 alone, and QR codes now account for roughly 12% of all phishing attacks, up from under 1% in 2021. The attack specifically slips past text-based email filters, since the malicious URL is hidden inside an image.

I wanted to add an endpoint to Presend's API that decodes a QR code from an uploaded image and, if it points to a URL, checks that URL against a malware/phishing database — decode plus reputation check in one call. The API runs on Cloudflare Workers, which meant no Canvas, no Node's Buffer, no filesystem, and a strict script-size budget. That constraint is what turned a "just wire up a library" task into a real build.

The easy half: JPEG