little-rat VS under-new-management

Great idea! We need a lot more visibility into what extensions are doing. I made little-rat [1] last year, to detect network calls coming from other extensions. Love to see more tools like yours!

[1] https://github.com/dnakov/little-rat

It says 1.0 in the extensions manager, but it was downloaded fresh this evening by clicking on the 'ZIP' link in your readme.md on here:

https://github.com/dnakov/little-rat/tree/main

2: https://github.com/dnakov/little-rat

I recently installed the Little Rat chrome extension, which I found here on HackerNews.

https://github.com/dnakov/little-rat

And what I found is that the Midnight Lizard chrome extension is monitoring my browsing-- sending home screenshots.

You can see examples here: https://ibb.co/JQvgt3p

Apparently my browsing data is being ingested by a company called "Mark Monitor Inc." (based on WhoIs search for the domain the data is sent to -- https://www.whois.com/whois/ytimg.com )

Nifty - but please do this more carefully:

https://github.com/dnakov/little-rat/blob/main/popup.js#L36

I do not want to have to worry about whether another extension can inject xss into yours with a crafted request/id/name.

This is a cool idea!

However, I have a number of reservations:

1. Firstly, the JavaScript code in the release version of the extension is 12MiB. This is a lot of code, with much of it in a bundled form, making it very difficult (if not almost impossible) to verify them against the originals in the case of React, lodash, etc.

2. It seems like the code uses an external API[0] to find the current owners of the installed extensions. While I appreciate that this may be one of the only ways to do it (since I imagine Google themselves would not appreciate an extension programmatically accessing the Chrome Web Store to find new developers) - and as far as I can see from the published code, it doesn't send any identifying data beyond what a normal Web request does, hence why I'm not identifying the site by name here - I would still urge caution as it might still cause alarm to someone examining their Web traffic and seeing a suspicious domain name, as the sort of person who would be interested in this extension is probably also the sort of person who would do that.

[0] https://github.com/classvsoftware/under-new-management/blob/...