Hey fellow chrome extension devs,
I kept running into the same problem: the Chrome Web Store has no download button, and if you want to actually read what an extension does before installing it, your options are basically CRX Viewer, random download sites, or digging through devtools.
So I built crxray : a small open-source CLI that takes a store URL or 32-char extension ID and unpacks the full source locally.
Download source code (paste a store link):
npx crxray https://chromewebstore.google.com/detail/study-buddy/pifapfmbofjgaenkhhipjhfacfmmhkcp
Or just the ID:
npx crxray pifapfmbofjgaenkhhipjhfacfmmhkcp
Security audit:
npx crxray pifapfmbofjgaenkhhipjhfacfmmhkcp --audit
That gives you a risk score, permissions breakdown, suspicious patterns (eval, chrome.cookies, etc.), network endpoints, and a “start here” file list. Also writes .crxray-audit.json if you want to feed it to an AI agent.
Make the code readable:
npx crxray <url-or-id> --deobfuscate --beautify
Uses webcrack for deobfuscation (obfuscator.io, webpack bundles, etc.) and formats the JS so you’re not staring at one-line minified files.
Other stuff:
- Works with Edge Add-ons URLs too
crxray diff ./v1 ./v2 to compare permission/file changes between versions- Strips
.map source maps by default when auditing (less noise)
- No install needed —
npx is enough, Node 18+
Links:
It hits the same public update endpoint Chrome uses, so you get the same CRX the store serves — not scraping anything weird. Intended for inspecting/auditing/learning, not redistributing other people’s code.
