MalExt Sentry

MalExt Sentry is an open-source platform designed for tracking and analyzing malicious or policy-violating browser extensions. It aggregates threat data from sources such as security researchers, SOC teams, community reports, and official policy violation reports, with a focus on accuracy and minimizing false positives. The platform is intended for use by security analysts, researchers, and detection engineers who need to identify and respond to browser extension threats across users and organizations.

The platform maintains a continuously updated database of malicious browser extensions, including details such as extension ID, detection reason, threat category, source, reporting date, and blocklist status. Each entry provides context on why the extension was flagged, who reported it, and when. MalExt Sentry emphasizes transparency by including the source origin and rationale for each detection. The database pulls from multiple channels, including Chrome Web Store policy violation reports, security researcher submissions, threat intelligence feeds, community detections, and Google's built-in blocklist.

MalExt Sentry offers machine-readable threat intelligence feeds in six formats to facilitate integration with security tools and workflows. 1 bundles for TAXII and OpenCTI, CSV for OpenCTI and Splunk, and generic JSON for custom scripts. All feeds update automatically with each new database commit, ensuring up-to-date intelligence for downstream systems.

json files. This parser extracts metadata such as name, version, and manifest version, identifies embedded scripts, highlights potential risk indicators, and enables downloading all extracted files as a ZIP archive for further inspection. MalExt Sentry is maintained as a community-driven, open-source project on GitHub, making its database, feeds, and parser accessible for collaborative security research and operational use.