Plasmo MV3 extension: on-device heuristics for unsafe forms, HTTP passwords, dark patterns, and phishing hostnames. Optional anonymous counter ping (off by default)—no page data in requests.
- Form shielding — blocks risky submits (sensitive fields on HTTP / deceptive hosts)
- Insecure input alerts — password fields on non-HTTPS pages
- Dark pattern alerts — pre-checked marketing/opt-in checkboxes near forms
- Phishing alerts — brand-in-subdomain + typosquat hostname checks
- Trusted sites — user whitelist for phishing false positives (
options.tsxor popup Manage) - Popup — toggles, local threat count; Settings — trusted sites + read-only system defaults
Forked in spirit from StormHacks 2024 (Donald, Tracy, Tracy). Rewritten in Plasmo/TypeScript with phishing, dark-pattern, and telemetry work on top.
Plasmo (MV3), React, TypeScript, Tailwind, @plasmohq/storage, tldts
Requires: Node 18+, pnpm (or npm).
pnpm install
pnpm devLoad build/chrome-mv3-dev at chrome://extensions (Developer mode). Turn Form Shielding on in the popup; enable Anonymous global counter only to test telemetry.
Test fixtures (must serve over HTTP, not file://):
pnpm test:pages # http://localhost:8080 — see test-pages/README.mdProd build / store zip:
pnpm build # → build/chrome-mv3
pnpm packageAll local; nothing synced or uploaded except opt-in telemetry (see below).
| Key | Purpose |
|---|---|
shielding-enabled, alerts-enabled, dark-patterns-enabled, phishing-alerts-enabled |
Feature toggles |
telemetry-enabled |
Anonymous counter opt-in (default off) |
threat-count |
Popup threat counter |
phishing-whitelist |
User-trusted registrable domains (phishing skip only) |
System default brand domains ship in assets/brand-registry.json (not stored per user).
- Heuristics: no server calls; page content/URLs stay in the browser.
- Telemetry (opt-in):
POST https://hackerhare.vercel.app/api/metrics/increment— empty body,x-hackerhare-agentheader only.
Policies: privacy · terms · site
| Permission | Why |
|---|---|
storage |
Settings, threat count, telemetry flag, trusted-site list |
<all_urls> content script |
On-device scans on visited pages |
hackerhare.vercel.app |
Opt-in anonymous counter only |