| Format | Name | Description | |
|---|---|---|---|
| MISP | Event JSON | Full event with extension attributes for MISP import. | |
| MISP | Warning List | Flag Extension IDs in MISP events automatically. | |
| STIX 2.1 | STIX Bundle | Complete SDO bundle for TAXII / OpenCTI. | |
| CSV | OpenCTI Indicators | Flat indicator list with confidence scores for OpenCTI. | |
| Splunk | Lookup Table | CSV lookup for SPL queries and registry monitoring. | |
| JSON | Generic Feed | Raw JSON array for custom scripts and integrations. | |
| RSS | Daily Digest | One post per day of new detections, for feed readers, Slack and Teams channels. | Open |
MalExt Sentry
Malicious browser extensions reported by researchers, store policy actions and the community, in one searchable list.
What it does
MalExt Sentry collects malicious and policy-violating browser extensions reported by security researchers, SOC teams and the community. Each entry records why the extension was flagged, who reported it and whether it is blocklisted, so analysts can check the extensions installed across their organization.
Data sources
The database pulls from:
- Chrome Web Store policy violation reports
- Security researcher submissions
- Threat intelligence feeds
- Community-contributed detections
- Google Chrome's built-in blocklist
New entries are added as threats are identified and verified. Each entry includes the extension ID, threat category (malware, bundling, scareware, etc.), source origin, and reporting date.
Threat intelligence feeds
Machine-readable exports are available in 7 formats for integration with security tools:
- MISP event JSON and warning lists
- STIX 2.1 bundles for TAXII / OpenCTI
- CSV for OpenCTI and Splunk
- Generic JSON for custom workflows
- RSS daily digest for feed readers and team channels
All feeds update automatically with each database commit.
Extension parser
Open a .crx, .zip or manifest.json, or fetch an extension by ID or store link. See its metadata, permission findings and every external host it contacts, browse and search the source, and download the extracted files as a ZIP.
Methodology
Entries are not automatically generated. Each threat is sourced from verified security researchers or official policy violation reports. Accuracy comes before speed: a false positive costs analysts more than a late entry. All entries include context: why the extension was flagged, by whom, and when.
Project
The database is maintained in the open on GitHub, for analysts, researchers and detection engineers.