Chrome Extension Scanner & Viewer

View source code or scan extensions for malware

\n\n

Example Extensions

Easy TikTok Video Downloader

fclobfmgolhdcfcmpbjahiiifilhamcg

\n View Source\n Scan\n

uBlock Origin

cjpalhdlnbpafiamejdnhcphjbkeiagm

\n View Source\n Scan\n

React Developer Tools

fmkadmapgofadopljbjfkapdkoienihi

\n View Source\n Scan\n

JSON Viewer

gbmdgpbipfallnflgajpaliibnhdgobh

\n View Source\n Scan\n

\n\n \n

\n\n

API Routes

\n /view/URL\n View extension source code in StackBlitz\n

\n /scan/URL\n Upload to VirusTotal and redirect to analysis\n

\n /api/crx/:id\n Download CRX file (CORS proxy)\n

\n\n \n\n`;\n\n return new Response(html, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}\n\nasync function handleCrxProxy(extensionId: string): Promise {\n // Validate extension ID format\n if (!/^[a-z]{32}$/.test(extensionId)) {\n return new Response(\n JSON.stringify({ error: \"Invalid extension ID format\" }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n console.log(`[vtotal] Proxying CRX for extension: ${extensionId}`);\n\n const crxUrl = buildCrxDownloadUrl(extensionId);\n\n try {\n const response = await fetch(crxUrl, {\n headers: {\n \"User-Agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\",\n Referer: \"https://chrome.google.com/webstore\",\n },\n });\n\n if (!response.ok) {\n throw new Error(`CRX download failed: ${response.status}`);\n }\n\n const crxData = await response.arrayBuffer();\n console.log(`[vtotal] Proxied CRX: ${crxData.byteLength} bytes`);\n\n return new Response(crxData, {\n headers: {\n \"Content-Type\": \"application/x-chrome-extension\",\n \"Content-Length\": crxData.byteLength.toString(),\n \"Access-Control-Allow-Origin\": \"*\",\n \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n },\n });\n } catch (error) {\n console.error(`[vtotal] CRX proxy error:`, error);\n return new Response(\n JSON.stringify({\n error: \"CRX download failed\",\n message: error instanceof Error ? error.message : \"Unknown error\",\n }),\n { status: 502, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n}\n\nfunction stripCrxHeader(buffer: ArrayBuffer): ArrayBuffer {\n const view = new DataView(buffer);\n if (buffer.byteLength < 12) return buffer;\n\n const magic = view.getUint32(0, true);\n if (magic !== 0x34327243) return buffer; // \"Cr24\" magic number\n\n const version = view.getUint32(4, true);\n let zipStart: number;\n\n if (version === 2) {\n const keyLen = view.getUint32(8, true);\n const sigLen = view.getUint32(12, true);\n zipStart = 16 + keyLen + sigLen;\n } else if (version === 3) {\n const headerLen = view.getUint32(8, true);\n zipStart = 12 + headerLen;\n } else {\n return buffer;\n }\n\n return buffer.slice(zipStart);\n}\n\nfunction isTextFile(filename: string): boolean {\n const textExtensions = [\n \"js\", \"mjs\", \"jsx\", \"ts\", \"tsx\", \"json\", \"html\", \"htm\", \"css\", \"scss\",\n \"less\", \"xml\", \"svg\", \"md\", \"txt\", \"yaml\", \"yml\", \"sh\", \"bash\", \"py\",\n \"rb\", \"php\", \"java\", \"c\", \"cpp\", \"h\", \"hpp\", \"rs\", \"go\", \"swift\",\n ];\n const ext = filename.split(\".\").pop()?.toLowerCase() || \"\";\n return textExtensions.includes(ext);\n}\n\nasync function extractExtensionFiles(extensionId: string): Promise> {\n const crxUrl = buildCrxDownloadUrl(extensionId);\n const response = await fetch(crxUrl, {\n headers: {\n \"User-Agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\",\n Referer: \"https://chrome.google.com/webstore\",\n },\n });\n\n if (!response.ok) {\n throw new Error(`CRX download failed: ${response.status}`);\n }\n\n const crxBuffer = await response.arrayBuffer();\n const zipBuffer = stripCrxHeader(crxBuffer);\n\n // Use fflate for server-side zip extraction\n // @ts-ignore: dynamic import from esm.sh\n const fflate = await import(\"https://esm.sh/fflate@0.8.2\");\n const zipData = new Uint8Array(zipBuffer);\n const unzipped = fflate.unzipSync(zipData) as Record;\n\n const files: Record = {};\n const decoder = new TextDecoder();\n\n for (const [path, data] of Object.entries(unzipped)) {\n if (isTextFile(path)) {\n try {\n files[path] = decoder.decode(data);\n } catch {\n // Skip files that can't be decoded as text\n }\n }\n }\n\n return files;\n}\n\nfunction generateStackBlitzFormHtml(extensionId: string, files: Record): string {\n // StackBlitz accepts POST to /run with form data\n // project[title], project[template], project[files][path]=content\n const inputs: string[] = [];\n\n inputs.push(``);\n inputs.push(``);\n\n for (const [path, content] of Object.entries(files)) {\n const escapedContent = content\n .replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(//g, \">\");\n inputs.push(``);\n }\n\n return `\n\n\n Opening in StackBlitz...\n \n\n\n

Opening extension in StackBlitz...

\n \n \n\n`;\n}\n\nasync function handleView(chromeStoreUrl: string): Promise {\n let extensionId: string;\n try {\n extensionId = extractExtensionId(chromeStoreUrl);\n } catch (error) {\n return new Response(\n JSON.stringify({\n error: \"Invalid URL\",\n message: error instanceof Error ? error.message : \"Could not parse extension ID\",\n }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n console.log(`[vtotal] Extracting extension server-side: ${extensionId}`);\n\n try {\n const files = await extractExtensionFiles(extensionId);\n console.log(`[vtotal] Extracted ${Object.keys(files).length} files`);\n\n const html = generateStackBlitzFormHtml(extensionId, files);\n\n return new Response(html, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n } catch (error) {\n console.error(`[vtotal] Extraction error:`, error);\n return new Response(\n JSON.stringify({\n error: \"Extension extraction failed\",\n message: error instanceof Error ? error.message : \"Unknown error\",\n extensionId,\n }),\n { status: 502, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n}\n\nasync function handleScan(chromeStoreUrl: string): Promise {\n // Validate input\n if (!chromeStoreUrl || !chromeStoreUrl.includes(\"chromewebstore.google.com\")) {\n return new Response(\n JSON.stringify({ error: \"Invalid URL\", message: \"Provide a valid Chrome Web Store URL\" }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n // Extract extension ID\n let extensionId: string;\n try {\n extensionId = extractExtensionId(chromeStoreUrl);\n } catch (error) {\n return new Response(\n JSON.stringify({\n error: \"Invalid URL\",\n message: error instanceof Error ? error.message : \"Could not parse extension ID\",\n }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n console.log(`[vtotal] Processing extension: ${extensionId}`);\n\n // Download CRX from Google's update service\n const crxUrl = buildCrxDownloadUrl(extensionId);\n console.log(`[vtotal] Downloading CRX from: ${crxUrl}`);\n\n let crxBlob: Blob;\n try {\n const crxResponse = await fetch(crxUrl, {\n headers: {\n \"User-Agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\",\n Referer: \"https://chrome.google.com/webstore\",\n },\n });\n\n if (!crxResponse.ok) {\n throw new Error(`CRX download failed: ${crxResponse.status} ${crxResponse.statusText}`);\n }\n\n crxBlob = await crxResponse.blob();\n console.log(`[vtotal] Downloaded CRX: ${crxBlob.size} bytes`);\n } catch (error) {\n return new Response(\n JSON.stringify({\n error: \"CRX download failed\",\n message: error instanceof Error ? error.message : \"Unknown error\",\n extensionId,\n }),\n { status: 502, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n // Upload to VirusTotal API v3\n const vtApiKey = Deno.env.get(\"VIRUSTOTAL_API_KEY\");\n if (!vtApiKey) {\n return new Response(\n JSON.stringify({\n error: \"Configuration error\",\n message: \"VIRUSTOTAL_API_KEY environment variable not set\",\n }),\n { status: 500, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n console.log(`[vtotal] Uploading to VirusTotal...`);\n\n let vtResult: { data?: { id?: string }; error?: { message?: string } };\n try {\n const formData = new FormData();\n formData.append(\"file\", crxBlob, `${extensionId}.crx`);\n\n const vtResponse = await fetch(\"https://www.virustotal.com/api/v3/files\", {\n method: \"POST\",\n headers: { \"x-apikey\": vtApiKey },\n body: formData,\n });\n\n vtResult = await vtResponse.json();\n\n if (!vtResponse.ok) {\n throw new Error(vtResult.error?.message || `VirusTotal API error: ${vtResponse.status}`);\n }\n\n console.log(`[vtotal] VirusTotal response:`, JSON.stringify(vtResult));\n } catch (error) {\n return new Response(\n JSON.stringify({\n error: \"VirusTotal upload failed\",\n message: error instanceof Error ? error.message : \"Unknown error\",\n extensionId,\n }),\n { status: 502, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n // Extract analysis ID and redirect to VirusTotal\n const analysisId = vtResult.data?.id;\n if (!analysisId) {\n return new Response(\n JSON.stringify({\n error: \"VirusTotal response error\",\n message: \"No analysis ID in response\",\n vtResult,\n }),\n { status: 502, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n const redirectUrl = `https://www.virustotal.com/gui/file-analysis/${analysisId}`;\n console.log(`[vtotal] Redirecting to: ${redirectUrl}`);\n\n return Response.redirect(redirectUrl, 302);\n}\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.slice(1); // Remove leading /\n\n if (path.startsWith(\"api/crx/\")) {\n return handleCrxProxy(path.slice(8));\n } else if (path.startsWith(\"scan/\")) {\n return handleScan(path.slice(5));\n } else if (path.startsWith(\"view/\")) {\n return handleView(path.slice(5));\n } else {\n return showIndex();\n }\n}","deleted","label","children",[],[159],"files",[157],"counts",{"_182":33,"_183":121,"_184":33,"_185":186,"_189":190},"pulls","branches","forks","envVars",{"_187":121,"_188":33},"count","emptyCount","connections",{"_187":33,"_191":33},"unfilledCount","contents",[194],{"_104":158,"_97":159,"_160":161,"_162":-5,"_163":145,"_164":144,"_165":166,"_106":195,"_101":168,"_169":170,"_171":172,"_173":22,"_174":98,"_100":196},["D",1769538731226],[159],"file","upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_95":96,"_97":98,"_102":206,"_185":211,"_219":22},{"_104":105,"_97":98,"_106":207,"_108":-5,"_109":22,"_110":111,"_112":113,"_114":-5,"_14":115,"_116":-5,"_117":22,"_118":-5,"_119":-5,"_120":121,"_16":122,"_123":-5,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_23":208,"_137":209,"_142":210,"_154":22},["D",1769250215652],{"_95":96,"_135":136},{"_95":96,"_139":136,"_14":115,"_140":141},{"_101":144,"_97":45,"_104":145,"_146":105,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":98,"_153":96},[212],{"_213":214,"_106":215,"_216":-5,"_112":217,"_218":22},"key","VIRUSTOTAL_API_KEY",["D",1769250289260],"updatedAt","VirusTotal API key for file scanning","isEmpty","isTeamOrg","actionData","errors"]

spookyuser

crxtotal

Environment variables