Scanners
Analyze a Chrome extension before it reaches a browser
Black Hat Arsenal Chrome extension analysis: static rules, permission review, and optional enrichment.
overview
What threatxtension does
threatxtension unpacks a Chrome extension and reports what it can do rather than what its listing claims. It runs static analysis over the bundled JavaScript, reads the manifest permission set, and scores entropy to flag packed or obfuscated payloads, which is the shape most malicious extensions take once they are past review.
Three input ports decide what gets analyzed. --file takes a local zip or crx and is the path to use for an extension you already hold or one your workflow seeded. --id and --url resolve an item from the Chrome Web Store instead. Two optional vault keys add enrichment: a VirusTotal key for reputation and an OpenAI key for a written summary of the findings.
The node emits findings.jsonl, so an extension review becomes a schedulable check instead of a one-time read. The Browser Extension Threat Scanner seeds a demo MV3 bundle and correlates the output, and swapping the seed for your own allow-list is the whole change needed to point it at a real fleet.
use cases
Where threatxtension fits
Review an extension before you allow it
Analyze the zip or crx and read the permission set and static findings before the extension lands on managed browsers.
Check a Web Store item by id
Pass the extension id or its store URL to pull and analyze the published bundle without downloading it by hand.
Flag packed or obfuscated payloads
Use the entropy signal to separate ordinary minified code from bundles that are hiding what they load at runtime.
Watch an allow-listed fleet for change
Schedule the scan across the extensions you permit so a quiet update that widens permissions shows up as a new finding.
reference
threatxtension inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| file | FILE | --file | Local extension zip/crx (preferred BYO) |
| id | STRING | --id | Chrome extension id |
| url | STRING | --url | Chrome Web Store URL |
Showing key inputs. threatxtension exposes 5 inputs in total.
Full flag reference (5 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| file | FILE | --file | Local extension zip/crx (preferred BYO) |
| id | STRING | --id | Chrome extension id |
| url | STRING | --url | Chrome Web Store URL |
| openai-api-key | STRING | --openai-api-key | Vault secret BH_OPENAI_API_KEY (optional LLM summary) |
| virustotal-api-key | STRING | --virustotal-api-key | Vault secret BH_VIRUSTOTAL_API_KEY (optional) |
example
Run threatxtension
# analyze a local bundle (preferred for BYO extensions)threatxtension --file extension.zip # or resolve a published item by idthreatxtension --id abcdefghijklmnopabcdefghijklmnop{ "tool": "threatxtension", "extension": "example-extension", "manifest_version": 3, "permissions": ["tabs", "<all_urls>", "scripting"], "finding": "remote script fetched at runtime", "entropy": 7.4, "severity": "high"}guidance
Choosing threatxtension
Reach for threatxtension when the artifact is a browser extension and you want manifest, static, and entropy signals in one pass. Use semgrep-scan when you have the unpacked source and want your own rules, and use trufflehog when the question is only which credentials are baked into the bundle.
semgrep-scan
Custom pattern rules over unpacked source. More control, no manifest or Web Store awareness and no entropy scoring.
trufflehog
Finds and verifies secrets inside the bundle. Narrower question, and it says nothing about the permission surface.
nuclei
Template checks against reachable services. Useful for the endpoints an extension talks to, not for the extension package.
workflows
Workflows using threatxtension
faq
threatxtension questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run threatxtension yourself
A packed extension or a store id feeds threatxtension, which writes manifest, static, and entropy findings for review.
Facts on this page come from the live Trickest tool library.