I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-s...
I am a mechanical engineer not a software developer. Any advice for me?
1. Unexpected URL's or IP addresses. Most attack vectors, for example a key-logger, need to call home at some point. Keep in mind, the address may be stored in pieces that are later concatenated together, or other tricks like using charAt() that will break a naive search for "http://".
2. Blobs of base64 code or other obfuscated text that are later eval'd...
3. Or really anything in an eval function is super suspicious.
4. Remote scripts that injected into pages. Does this have plugin have a solid reason to do that? Otherwise, it's an obvious backdoor even if not necessarily nefarious.
5. Look for code that targets specific domains that are out of scope. If you're looking at an extension for a color picker, you wouldn't expect to see code targeting specific high-value sites like Paypal or Gmail.
6. If it's an email productivity add-on, is it stealing emails and contact information from signatures? It's surprisingly common.
7. Some extensions will try to swap out the advertiser IDs or change affiliate links. Unless it's an adblocker, you shouldn't expect to see any code targeting ads.