What we find in the stores we catalog
We download, unpack and rate every extension in the Chrome Web Store and Firefox Add-ons, and every package crossing ten registry firehoses. These are the things worth writing down.
Where a finding is someone else's, we say so and link them. Where our own detection missed something, we say that too — the second kind is usually the more useful post.
A package with 147 million weekly downloads shipped a preinstall hook it never had
Version 11.1.6 of file-entry-cache added an install-time script and a 727KB
obfuscated file to a package that had shipped neither for years. npm removed the version
the same day we flagged it. How to check whether it reached your builds.
533 packages we flagged before the registry removed them
Every package we graded malicious before a public advisory existed, and that the registry subsequently pulled. Generated from our detection records rather than written by hand, and dated by when each finding was made. Packages we flagged that were never removed are deliberately absent.
A “VPN” with 70,000 users that is not a VPN
Three Chrome extensions borrow the names of ZenMate and ExpressVPN. They cannot route your traffic anywhere — they never ask for the permission that would let them. What they do instead is send the address of every page you look at to a third-party server, without encryption.
215 fake VPN extensions are still on the Chrome Web Store
A VPN extension is a strange thing to fake, because a fake one gets exactly what a real one gets: the ability to see and redirect everything you do online. Twelve groups of extensions each impersonate several competing VPN brands from one shared codebase — and all 215 are still installable today.
More as we find it. The extension catalog behind this work is browsable at /extensions, and the live package feed at /threats.