Repository: github.com/its-not-easy...
Paper: arxiv.org/pdf/2509.21590

Joint work with Ben Rosenzweig, @rossoalfiere.bsky.social, and Giovanni Apruzzese

We also provide ground truth (benign or malicious), category, manifest version, date of last update, and ID of each extension. Put simply, you can just (i) grab the dataset, (ii) load it into a pandas dataframe, and (iii) train & test any type of ML-based classifier on it. Enjoy!

Each extension in our dataset is provided as a *feature vector that is ready for ML-based experiments*. For instance, we provide 2.5k features extracted from extensions’ source code and over 2k features extracted from extensions’ metadata.

For the results, look at the paper (spoiler: the browser- extension ecosystem is strongly impacted by concept drift). For those who want to get their hands dirty, we release all our codebase in our GitHub repository.

In our new TWEB paper, we collected ~100k browser extensions that appeared on the Chrome Web Store in 2012–2023 and used them to develop and test a set of classifiers based on supervised machine learning (ML).