No week passes without us learning that some Chrome extension, even a very well-known one, contains malicious code. Some want to mine cryptocurrencies with your computer, others want to steal your data, and so on. How do you know that an extension has no sinister intentions? A good option is to study the code and structure of any Chrome extension you want to install, and that's where the manual download system Chrome Extension Downloader comes in.
After what happened with SafeBrowse and many other extensions, it is clear that the people responsible for the Chrome store need to make several adjustments to protect users from malicious extensions. That time it was a miner, but later it could be something even worse. Unfortunately, user comments and the developer's reputation have ceased to be adequate criteria for judging a piece of software. The so-called "common sense" is defeated by these sneaky attacks deployed through legitimate software, which leads us to more extreme positions like "paranoia works".
Analyze an extension before installing it
What can we do when the threat comes inside a supposedly harmless extension? In the case of Google Chrome, see its code. The first step is to visit the Chrome store and find the extension that interests us. Once we have the exact URL, we go to the Chrome Extension Downloader portal. Inside, we paste the extension link and press the "Download Extension" button. The site will then download the file in .crx format, and to see its contents we need to change the extension to .zip.
The standard Windows decompressor is not compatible, but by using a variant like 7-Zip, its contents are automatically exposed. The rest depends on each user. Some extensions are huge (for example, LastPass takes up 10 MB), and exploring their code will take a long time. Once we are convinced of their integrity, we can drag the crx to Chrome, or download it from the store as usual.
