[HN Gopher] JSON Formatter Chrome Plugin Now Closed and Injectin...
___________________________________________________________________
JSON Formatter Chrome Plugin Now Closed and Injecting Adware
Author : jkl5xx
Score : 112 points
Date : 2026-04-10 18:34 UTC (4 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| jkl5xx wrote:
| Noticed a suspicious element called give-freely-root-
| bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today.
|
| Turns out about a month ago, the popular open source [JSON
| Formatter chrome
| extension](https://chromewebstore.google.com/detail/json-
| formatter/bcji...) went closed source and started injecting
| adware into checkout pages. Also seems to be doing some
| geolocation tracking.
|
| I didn't see this come up on hn, so I figured I'd sound the alarm
| for all the privacy-conscious folks here.
|
| At this point, I feel like browser extension marketplaces are a
| failed experiment. I can just vibecode my own json pretty-printer
| extension and never deal with this problem again.
| IncreasePosts wrote:
| Agreed with that. My main use of AI is just writing ultra
| minimal apps that are specifically tailored to my needs,
| instead of using a larger app(or plugin or whatever) that is
| controlled by a third party and is usually much more than I
| need, and doesn't exactly fit my needs, and requires ad hoc
| configuration.
|
| I'm wondering when/if this is going to bite me in the butt
| hn_throwaway_99 wrote:
| Thanks for posting this. I think it's such a shitty thing to
| do. I don't have much of a problem if an original author wanted
| to do a closed fork of an open source project, but to start
| injecting ads, without warning, to folks who have already
| installed your generic JSON formatter and phrase it as "I'm
| moving to a closed-source, commercial model in order to build a
| more comprehensive API-browsing tool with premium features." -
| seriously, f' off.
|
| I agree that browser extension marketplaces are a failed
| experiment at this point. I used to run security an a fin
| services company, and our primary app had very strict Content
| Security Policy rules. We would get _tons_ of notifications to
| our report-uri endpoint all the time from folks who had
| installed extensions that were doing lots of nefarious things.
| braebo wrote:
| We could use llms to scan source code and list all of the
| behavior not listed in the extensions page, like adware and
| geolocation tracking for example. Then another LLM locally to
| disable it and warn you with a message explaining the
| situation.
| fg137 wrote:
| How did you "notice" a suspicious element in the inspector? Do
| you routinely look at the DOM?
| cluckindan wrote:
| The extension injects its "gimme money" elements even on
| localhost pages.
| ronsor wrote:
| > Do you routinely look at the DOM?
|
| You don't?
| madeofpalk wrote:
| I do. Then again, I'm a web developer so looking at the DOM
| is my day job.
| jkl5xx wrote:
| I did webdev for a long time, so yeah. If you want the story,
| I was looking into guix on asahi and ended up on
| https://www.asahi-guix.org/ which didn't load anything, so I
| checked the page source and noticed the element.
| munificent wrote:
| _> I feel like browser extension marketplaces are a failed
| experiment._
|
| People rightly criticize all of the problems around vendor-
| lock-in and rent-seeking with platform app stores, but this is
| a good example that they do indeed provide some value in terms
| of filtering out malware.
|
| The degree to which they are successful at that and add enough
| value to overcome the downsides is an open question. But it's
| clear that in a world where everyone is running hundreds of
| pieces of software that have auto-update functionality built in
| and unfettered access to CPU power and the Internet,
| uncontrolled app stores a honeypot for malicious actors.
| josephcsible wrote:
| > People rightly criticize all of the problems around vendor-
| lock-in and rent-seeking with platform app stores, but this
| is a good example that they do indeed provide some value in
| terms of filtering out malware.
|
| But browser extension marketplaces aren't a free-for-all;
| they're exactly like the platform app stores in all the bad
| ways.
| anonymous908213 wrote:
| Whatever value they provide is completely and totally
| irrelevant compared to giving Microsoft, Google, and Apple
| the unilateral discretion to end any software developer's
| career, or any software development business, by locking them
| out of deploying software with no recourse. Nobody has a
| problem with optional value-add stores, but all three have or
| are moving towards having complete control of software
| distribution on the hardware platforms used by billions of
| people.
| jabwd wrote:
| This also ignores that mobile phones are now being used as an
| effective botnet. Just gotta get some poor devs to include
| your SDK and off you go.
|
| AI companies make use of these botnets quite a bit as well.
| Why don't we hear more about it? because it is really really
| really hard to inspect what is actually happening on your
| phone. This post actually kinda disproves that the closed
| rent seeking model is better in any way.
| Animats wrote:
| It's OK to inject ads, but not OK to remove them, under
| Google's current policies.
| Legend2440 wrote:
| Well no, actually. Both halves of that statement are false.
|
| Injecting ads will get you removed from the extension store
| if caught, while adblockers are advertised on the front page
| of the store.
| Animats wrote:
| Google's "Manifest 3" rules, vs. ad blocking, in Ars
| Technica.[1]
|
| Did the JSON formatter with ads get kicked out of the
| extension store yet?
|
| [1] https://arstechnica.com/gadgets/2024/08/chromes-
| manifest-v3-...
| SquareWheel wrote:
| Manifest 3 explicitly enables ad blocking through the
| declarativeNetRequest API. It's trivial to do so, and
| many blockers exist in the Chrome Web Store.
| Legend2440 wrote:
| Everybody freaked out about Manifest v3, but I'm running
| Chrome + uBlock and still not seeing any ads. Seems like
| a nothingburger to me.
| Aurornis wrote:
| Several of the top Chrome extensions on their charts are ad
| blockers: https://chromewebstore.google.com/top-
| charts/popular?hl=en
|
| They have an API basically dedicated to this: https://develop
| er.chrome.com/docs/extensions/reference/api/d...
|
| I think you may have been confused about the Manifest V3 API
| changes, which were controversial because they didn't support
| every feature of the old API. The mainstream ad blockers all
| wrote new versions for Manifest V3.
| j1elo wrote:
| > _went closed source and started injecting adware into
| checkout pages ... [and] geolocation tracking._
|
| Maybe we should resort to blame and shame publicly this sort of
| actions. DDoS their servers, fill their inbox with spam,
| review-bomb anything they do. Public court justice a la 4chan
| trolling. Selling out is a lawful decision, of course, but
| there is no reason it shouldn't come with a price tag of
| becoming publicly hated. In fact, it might help people who are
| on the verge to stay on the ethical side of things (very
| ironically).
|
| I'm just kinda joking (but wouldn't hate it if I was rugpulled
| and the person that did it got such treatment)
| pigpop wrote:
| Calm down, just spreading the word that the extension is
| adware and having everyone uninstall it is sufficient to
| demonstrate that this move was a mistake. Trying to ruin
| someone's life is going completely overboard. Repercussions
| should be proportionate, you don't shoot people for stealing
| a candy bar.
| nightpool wrote:
| The same thing happened to ModHeader
| https://chromewebstore.google.com/detail/modheader-modify-ht...
| -- they started adding ads to every google search results page I
| loaded, linking to their own ad network. Took me weeks to figure
| out what was going on. I uninstalled it immediately and sent a
| report to Google, but the extension is still up and is still
| getting 1 star reviews.
| gsibble wrote:
| Is it me or is this happening more and more frequently?
| iza wrote:
| Maybe but it's always been a problem. I've been receiving
| offers to monetize or sell my extension for over a decade.
| jlarocco wrote:
| It seems like it. I just stopped using a "windowed full screen"
| extension that did this.
| tadfisher wrote:
| WebExtension permissions are fucking broken if the set of
| permissions necessary to reformat and style JSON snippets is
| sufficient to inject network-capable Javascript code into any
| page.
|
| If basically any worthwhile extension can be silently updated to
| inject <script> tags anywhere, then it's time to call this a
| failed experiment and move on. Bake UBlock and password-
| management APIs into the browser. Stop the madness.
| michaelt wrote:
| Given that the worlds biggest browser is made by the worlds
| biggest ad company, the chances it'll ever bake in a working ad
| blocker are approximately zero.
| SquareWheel wrote:
| Chromium does include an ad blocker for "intrusive ads". ie.
| Those using many resources, flashing, auto-playing sounds, or
| otherwise behaving badly.
|
| https://support.google.com/chrome/answer/7632919
| Groxx wrote:
| - click install
|
| - "It can: Read and change all your data on all websites"
|
| It's not alarming sounding enough for what that implies, but
| "it can trigger requests under its control" seems fairly
| obvious from that. The permission it uses to inject ads can be
| used to inject ads (or block them).
|
| Why a JSON formatter needs _any permission at all_ is something
| anyone installing it should be asking themselves.
|
| ---
|
| This is not meant to imply that I think the permission model of
| extensions in chrome or firefox is _good_ , clearly it is not.
| But it's _significantly_ better and more fine-grained than
| every single other widely-used permissions system in consumer
| apps. Ideally there should be more carve-outs for safe niches
| like a "read a JSON file, rewrite it into something that does
| not need javascript or external resources" could use, but also
| that kind of thing is likely to be nigh impossible to make
| "complete".
| tadfisher wrote:
| "Read and change data on all websites" does not, to me, imply
| "make network requests on the user's behalf". Yes, I can put
| on my developer hat and _surmise_ that, under the hood, the
| extension 's injected payload can make network requests by
| adding <script> elements to the DOM. No user will ever
| understand this, no matter how much you try to educate them
| through the permission prompt.
|
| This ends up being significantly _worse_ than any other
| widely-used permissions system, because injected scripts act
| as the website, not the extension. If you 've already granted
| location permission to a website, then it is effectively
| granted to the extension. There is no other ecosystem that
| works like this.
|
| And to do basically anything worthwhile, including certain
| types of content blocking, you need this God permission that
| essentially disables the WebExtension permissions system.
| This should never have been greenlit in the first place.
| strictnein wrote:
| Been researching extensions for a while now at the day job and
| I'm preparing some disclosures to the major browser vendors.
|
| The amount of absolute clusterfuckery in browser extensions is
| endless. One of the biggest issues is with how extensions
| define their permissions and capabilities in their
| manfiest.json files. I've reviewed thousands of these now, and
| probably only 5-10% of extensions actually get it right. There
| are just so many confusing and overlapping permissions,
| capabilities, etc.
|
| It is a failed experiment, but I don't think Google can just
| shut it off, because of their market dominance. They'd be
| disconnecting some of their competitors from their users. They
| need to move to an updated manifest spec that is (more) secure
| by default, has fewer footguns, etc.
| maxloh wrote:
| For context, the latest version of extension spec (Manifest
| V3) is just 1.5 years old. It isn't something old or legacy.
| maxloh wrote:
| To install a JSON formatter, you need to grant the following
| access:
|
| 1. Access to the page DOM to read the raw JSON content.
|
| 2. Permission to modify the DOM to display the formatted
| results.
|
| Unfortunately, these requirements necessitate broad host
| permissions, which allow an extension to inject ads or track
| user behaviors. There is no alternative way to define a strict
| security boundary that allows these specific permissions while
| preventing abuses.
| tadfisher wrote:
| > There is no alternative way to define a strict security
| boundary that allows these specific permissions while
| preventing abuses.
|
| Maybe you're right, and there isn't. Does it not follow that
| we should probably require extensive review and open-source
| reproducible builds before allowing any such extension on the
| browser extension stores?
| what wrote:
| I'm pretty sure you can setup without broad host permissions,
| you just probably wouldn't like it. You'd have to click a
| button to trigger the behavior, which I think requires you to
| click another button to approve access. Or configure the
| extension to allow access to specific domains after install,
| which will also have a permission prompt.
| computerfriend wrote:
| Interesting that the author, Callum Locke, seems to be a real
| person with a real reputation to damage. Previously this would
| have been a trust signal to me, I figured real developers would
| be less likely to go rogue given the consequences.
| ayewo wrote:
| The tempation is quite strong, especially for popular
| extensions
|
| Here's what it can look like to an author of a popular
| extension:
|
| https://github.com/extesy/hoverzoom/discussions/670
| extesy wrote:
| Depends on the personal situation. An extension with 2 million
| users can generate a very meaningful revenue. My extension has
| only 300k users, but offers that I received over years [0]
| would have been significant in some lower-income country.
|
| [0] https://github.com/extesy/hoverzoom/discussions/670
| robocat wrote:
| Extracts from two different offers: For
| example, your income for the 10k users will be ~ $ 1000 per
| month, users 20k ~ $ 2000 per month... 100k users ~10 000 $,
| and so on. ARPDAU (Average Revenue Per Daily
| Active User) basis - In average we have $0.007-0.011/user, US
| is $0.018.
| rzmmm wrote:
| Browser extension maintainers routinely get contacted by more
| or less shady directions. This is likely a case of maintainer
| selling out after getting a good offer.
| captn3m0 wrote:
| The JSONView extension on Firefox was targeted a while ago.
| (2017?)
|
| I only found out because Mozilla forced an uninstall with a
| warning and then I had to go down Bugzilla to find the impact (it
| leaked browser visit URLs).
| jansommer wrote:
| Guy talks about switching to the "Classic" version if
|
| > you just want a simple, open source, local-only JSON-formatting
| extension that won't receive updates.
|
| Wow that sounds like a tough choice. JSON formatting is moving at
| such a fast pase that I don't know if I should pay a JSON
| formatting SaaS a monthly subscription, or if I really can live
| without updates.
| panstromek wrote:
| Depends on how many JSON tokens you need to format. I recommend
| getting JSON ForMAX+ with 200k tokens and 100k sign in bonus.
| brianmcnulty wrote:
| I heard that JWTs are 5x the price of JSON tokens but only 3x
| if you have JSON ForULTRA+ (new) (for work or school).
| smallmancontrov wrote:
| The more you buy, the more you save!
| hamdingers wrote:
| Legally speaking that's for entertainment purposes only
| cyanydeez wrote:
| You have to add the final "]" or "}" yourself but json
| strings are free!
| henry2023 wrote:
| Fortunately, Microsoft C# Copilot 2 Pro is already bundled
| with JSON forULTRA+ for free. (Not to be confused with
| Microsoft C# Copilot Pro)
| voodoo_child wrote:
| Big-JSON is coming for us
| endofreach wrote:
| Lol. I mean what the hell is this. I have this weird feeling
| this guy got tricked by an LLM into thinking this move is
| smart... "what you've built is not just a json formatter, it's
| the next big...".
|
| I mean good luck to that guy. Everyone should have a shot at
| turning his free work into something worth it. I think i've
| been using that extension as well. But yeah, i never cared
| enough to know if it was this one. But i do hope there are
| others who did & he can surprise me and turn this user base
| into customers of a commercial product. If he pulls that of,
| i'd be truly impressed.
| arikrahman wrote:
| I what feature can even be added to the product that won't be
| immediately replicated in a fork?
| mirekrusin wrote:
| Nobody knows what but everybody knows they won't be
| replicated.
|
| Chat with your json?
|
| Facebook but for jsons?
|
| Send json to blockchain?
|
| It's so bad that it's exciting, can't wait for an update.
| jmuguy wrote:
| I actively try to get coworkers to audit, remove and work without
| browser extensions. Google and Firefox clearly do not care to
| spend even a modicum of effort to police their marketplaces.
| There's only a few I would trust and assume all others to be
| malware now or at some point in the future.
| binaryturtle wrote:
| I guess you really need to unpack each and every extensions
| before installation and carefully inspect the code manually to
| see if it only would be doing what the extensions is advertising.
|
| Darn...
|
| and I thought that the JSLibCache extension was forcing every
| site into UTF-8 mode (even those that need to run with a legacy
| codepage) was a critical issue. A problem I encountered
| yesterday... took me a while to figure out too.
| vadansky wrote:
| Or just use it as an example to vibecode your own. Extension
| laundering through vibecoding.
| wesbos wrote:
| I noticed this a week ago. Ended up building my own that has all
| the features I love from using several over the years.
|
| https://github.com/wesbos/JSON-Alexander
| nip wrote:
| I was approached twice to add << a search and tracking script >>
| to my 35k+ user-based extension.
|
| Now I know what would have happened if I had accepted.
| jimrandomh wrote:
| I think the main problem here is the ideology of software
| updating. Updates represent a tradeoff: On one hand there might
| be security vulnerabilities that need an update to fix, and
| developers don't want to receive bug reports or maintain server
| infrastructure for obsolete versions. On the other hand, the
| developer might make decisions users don't want, or turn even
| temporarily (as in a supply chain attack) or permanently (as in
| selling off control of a browser extension).
|
| In the case of small browser extensions from individual
| developers, I think the tradeoff is such that you should
| basically never allow auto-updating. Unfortunately Google runs a
| Chrome extension marketplace that doesn't work that way, and
| worse, Google's other business gives them an ideology that
| doesn't let them recognize that turning into adware is a
| transgression that should lead to being kicked out of their
| store. I think that other than a small number of high-visibility
| long-established extensions, you should basically never install
| anything from there, and if you want a browser extension you
| should download its source code and install it locally as an
| unpacked extension.
|
| (Firefox's extension marketplace is less bad, but tragically,
| Firefox doesn't allow you to bypass its marketplace and load
| extensions that you build from source yourself.)
| roozbeh18 wrote:
| last night I got an alert from Malwarebytes on my machine that it
| quarntined an extension.
|
| Quarantined - PUP.Optional.Hijacker.
| C:\USERS*\APPDATA\LOCAL\GOOGLE\CHROME\USER
| DATA\DEFAULT\EXTENSIONS\BCJINDCCCAAGFPAPJJMAFAPMMGKKHGOA
|
| wondered what the extension was... JSON Formatter
| pfg_ wrote:
| Firefox has this ability by default and I find it very useful.
| And it will never get sold to some random person to be replaced
| with adware.
___________________________________________________________________
(page generated 2026-04-10 23:00 UTC)