JSON Formatter Chrome Plugin Now Closed and Injecting Adware

https://github.com/callumlocke/json-formatter

GitHub - callumlocke/json-formatter: Makes JSON easy to read.

Makes JSON easy to read. Contribute to callumlocke/json-formatter development by creating an account on GitHub.

GitHub

Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today.

Turns out about a month ago, the popular open source [JSON Formatter chrome extension](https://chromewebstore.google.com/detail/json-formatter/bcji...) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking.

I didn't see this come up on hn, so I figured I'd sound the alarm for all the privacy-conscious folks here.

At this point, I feel like browser extension marketplaces are a failed experiment. I can just vibecode my own json pretty-printer extension and never deal with this problem again.

Before you continue

It's OK to inject ads, but not OK to remove them, under Google's current policies.

Well no, actually. Both halves of that statement are false.

Injecting ads will get you removed from the extension store if caught, while adblockers are advertised on the front page of the store.

Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1]

Did the JSON formatter with ads get kicked out of the extension store yet?

[1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...

Chrome’s Manifest V3, and its changes for ad blocking, are coming real soon

Chrome is warning users that their extension makers need to update soon.

Ars Technica
Manifest 3 explicitly enables ad blocking through the declarativeNetRequest API. It's trivial to do so, and many blockers exist in the Chrome Web Store.