A browser extension that audits the npm build chain and gates Chrome Web Store publishes when malicious packages are detected
Chrome extension developers ship npm-sourced builds directly to the Web Store with no integrity check between dependency install and publish, leaving the pipeline wide open to supply chain injection. A $8.5M Trust Wallet theft and dozens of Cyberhaven/VPNCity-style compromises in 2024-2025 prove the gap is real and the blast radius is massive. This tool sits inside the developer's browser, audits every dependency in the build artifact before publish, and hard-blocks the Web Store submission if any package shows signs of malicious modification.
Demand Breakdown
Social Proof 2 sources
Gap Assessment
4 tools exist (Socket.dev, Snyk Open Source, JFrog Xray, Cyberhaven) but gaps remain: No integration with the Chrome Web Store publish pipeline. Flags packages in the repo but does not gate or block the actual Web Store submission. No extension-specific artifact diffing or provenance attestation tied to the publish event.; No Chrome extension-specific controls, no Web Store publish gate, no artifact-level diff between last live extension version and the build about to ship. Enterprise pricing unsuited for indie extension developers..
Features7 agent-ready prompts
Competitive LandscapeFREE
| Product | Does | Missing |
|---|---|---|
| Socket.dev | Scans npm packages for malicious code and supply chain threats at install or CI time; integrates with GitHub PRs to flag risky dependencies. | No integration with the Chrome Web Store publish pipeline. Flags packages in the repo but does not gate or block the actual Web Store submission. No extension-specific artifact diffing or provenance attestation tied to the publish event. |
| Snyk Open Source | General-purpose dependency vulnerability and license scanning integrated into CI pipelines for web projects. | No Chrome extension-specific controls, no Web Store publish gate, no artifact-level diff between last live extension version and the build about to ship. Enterprise pricing unsuited for indie extension developers. |
| JFrog Xray | Binary and dependency scanning across package registries including npm; integrates with Artifactory for artifact governance. | No Chrome extension publish pipeline awareness. Requires full JFrog Platform adoption. No browser-side publish gate or Web Store API integration. Cost and complexity prohibitive for extension teams. |
| Cyberhaven | Browser extension that monitors data movement and prevents data exfiltration from the enterprise browser environment. | Monitors what data leaves via the browser; does not audit the build pipeline or block a developer from publishing a compromised extension to the Chrome Web Store. Solves the employee-side DLP problem, not the developer-side supply chain problem. |
Leads135BUILDER
Sign in to unlock full access.