Button Stealer

github: https://github.com/anatolyzenkov/button-stealer

reminds me of https://adnauseam.io/ 's clicked ad view https://adnauseam.io/img/adnauseam_vault.png

Is there a particular reason this uses Chrome-specific APIs instead of the standard WebExtensions API? I have considered experimenting with web extensions, but wondering what the practical limitations of the standard API are compared to the browser-specific APIs.

I'd be worried about installing these sorts of extensions in case someone decides to offer the developer a lucrative amount of money to buy it and then uses it for less-than-fun purposes. Not sure if they'd need additional permissions for it, but at least the current content script is ran against "https://*/\*" already.

Issue with this “benign” extension is that it will be using

“host_permissions”: “”

In its manifest means it can basically do anything on any webpage you visit, scrape data etc.

As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous