I have a content script in a browser extension which will detect if the devtools is opened by the user (Chrome only).

var antihack = function() {};
antihack.toString = function() {
 var host = window.location.host.replace(/^www\./i, "");
 chrome.runtime.sendMessage({type: 'antihack', origin: host});
 console.log('%c Warning do not paste code into this window.','color:red;font-size:16px;');
 clearInterval(checker);
}
var checker = setInterval(()=>{
  console.profile(antihack)
}, 1000)

When i look at the stats i see a lot more warnings than i would expect and also very sharp daily increases. I would expect around 5% of users opening the devtools but i am well over 20%.

Is there any possibility of false positive triggering it without opening the devtools manually ?

The extension is currently unpublished until i find the reason. The script to detect the devtools opening is currently the most reliable i have found working on the latest version of Chrome, i sourced my code from stackoverflow