DEV Community

InexperiencedPotato
InexperiencedPotato

Posted on

Catch Chrome extension packaging mistakes before you upload (free, local tool)

#webdev #opensource #python #google

Every extension developer has done it: you zip the folder, upload it, and then
find out something small was wrong. A file the manifest points to isn't in the
ZIP, a default locale is missing a message, or an icon isn't really a PNG.

I wanted to catch those mistakes before uploading, without sending my
extension anywhere. So I built ExtensionRelease Guard, a small Windows
desktop app that inspects the ZIP locally.

ExtensionRelease Guard auditing a sample extension

What it checks

  • The ZIP itself: absolute or path-traversal entry names, duplicate and case-colliding names, encrypted entries, symlinks, and suspiciously high compression ratios.
  • manifest.json: required fields and basic structure.
  • References: files the manifest points to (scripts, icons, resources) that don't exist in the archive.
  • Locales: the default locale and its messages.
  • Icons: that icon files really are the image type they claim to be.

Each finding comes with a short note on why it matters and what to do, and
the app gives a readiness summary. A Manifest tab lists the permissions and
host access the extension requests, labelled as observations or confirmed
inconsistencies.

Other things it does

  • Drop a ZIP onto the window to audit it.
  • Export a report as HTML, JSON or TXT.
  • Compare two saved JSON reports to see which findings are new, fixed or unchanged between builds.

What it does not do

It is a pre-release inspection aid, not a guarantee. It reads the archive
without extracting or running anything, so it can't judge what your code does,
and a clean result does not mean your extension is safe or will pass Chrome
Web Store review. It only catches the problems it knows how to look for.

Try it

It's free and open source (MIT), for Windows. The executable is unsigned, so
SmartScreen may warn; the SHA-256 is in the release notes so you can verify
the download.

I'm the author. I'd like feedback on false positives and on checks you wish it
had. Issues and pull requests are welcome. If you find it useful, there's an
optional Ko-fi link.

Top comments (0)