toborrm9
Show HN: Malext.io is out – Database of malicious Chrome extensions
Show HN: Audit the browser for malicious extensions removed from Chrome Store
Re:
on Saturday April 11, 2026 @11:18AM (#47731358)
Malicious Chrome extensions don't always get removed from the Web Store right away and I couldn't find a maintained list of malicious ones so I built this open source tool!
GitHub: https://github.com/toborrm9/malicious_extension_sentry Extension: https://chromewebstore.google.com/detail/malext-sentry/bpohi...
Show HN: Malicious Extension Sentry: database of removed Chrome/Edge extensions
I noticed there wasn't a maintained, verified list of malicious Chrome/Edge extensions, only behavioral scanners with high false positive rates. So I built one. The database only includes extensions with clear removal signals: official store removals or researcher reports that led to action. No behavioral guesswork.Live dashboard (daily updates): https://malext.toborrm.comGitHub + database:...
Discovered a malicious Chrome extension targeting Apple App Store developers
Re:Show HN: Daily-updated database of malicious browser extensions
on Saturday February 07, 2026 @05:00AM (#46922643)
Yes i'm working on it
Re:Show HN: Daily-updated database of malicious browser extensions
on Saturday February 07, 2026 @05:00AM (#46922642)
Working on it :)
Re:Show HN: Daily-updated database of malicious browser extensions
on Friday February 06, 2026 @11:54AM (#46915203)
Great point. The current setup is exactly what you're describing, a fully local verification with no phone-home behavior.
The CLI/GUI tools I'm building read your locally installed extensions, extract their IDs, and check them against the CSV (which you can clone/download). No data leaves your machine during the scan.
The only "central" piece is the GitHub-hosted CSV itself, which is just a static file anyone can audit, fork, or host themselves. No API calls, no telemetry, no server lookups.
You're right that this design prevents the verification tool from becoming an attack vector. Even if my repo got compromised, worst case is a bad CSV, your local scan process stays isolated.
I'm also looking at surfacing critical permissions for locally installed extensions,things like "access to all websites," "read clipboard," etc. That way users can make informed decisions about what to keep based on what's actually authorized, even if an extension isn't in the malicious database yet.
Appreciate the security-minded feedback.
Show HN: Daily-updated database of malicious browser extensions
https://github.com/toborrm9/malicious_extension_sentry
Hey HN, I built an automated system that tracks malicious Chrome/Edge extensions daily.The database updates automatically by monitoring chrome-stats for removed extensions and scanning security blogs. Currently tracking 1000+ known malicious extensions with extension IDs, names, and dates.I'm working on detection tools (GUI + CLI) to scan locally installed extensions against this database, but...