HN Explorer

Show HN: Daily-updated database of malicious browser extensions (github.com)

17 points by toborrm9 ↗ HN
Hey HN, I built an automated system that tracks malicious Chrome/Edge extensions daily.

The database updates automatically by monitoring chrome-stats for removed extensions and scanning security blogs. Currently tracking 1000+ known malicious extensions with extension IDs, names, and dates.

I'm working on detection tools (GUI + CLI) to scan locally installed extensions against this database, but wanted to share the raw data first since maintained threat intelligence lists like this are hard to find.

The automation runs 24/7 and pushes updates to GitHub. Free to use for research, integration into security tools, or whatever you need.

Happy to answer questions about the scraping approach or data collection methods.

7 comments

[ 337 ms ] story [ 1222 ms ] thread
KevinChasse
Nice work. One thing I've noticed with locally checking extensions against threat lists is that the verification process itself can become a target. Stateless, deterministic verification — where hashes or IDs are derived on-device and never stored centrally — reduces risk of supply chain or server-side compromise. It’s a subtle design point, but it can prevent a malicious actor from using the verification system itself to exfiltrate data.
julius
Super cool. Brave support by any chance? Using Linux, it found my Chrome, but thats not my primary browser.
wasmainiac
Super cool, I hope this gets the attention it deserves!
TheKnack
It appears that some of the extensions in your block list originate from a supply chain attack which compromised some extensions, but which have since been fixed and are no longer compromised and have returned the Chrome store. This post discusses matching both the ID and version to detect compromised extensions without creating false positives.

For example, only v4.00 of Bookmark Favicon Changer was compromised. Earlier and later versions are clean.

https://www.elastic.co/blog/how-to-detect-malicious-browser-...