Remote Script Reference Detector

Remote script reference detector

Short answer

A remote script reference detector looks for static signs that an extension may load executable JavaScript from outside its package. It flags external script elements, importScripts URLs, eval and Function constructor use. These are indicators, not proof that remote code ran.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Why remote code matters

Remote code can change after the extension is reviewed. A package that looks harmless today could load different logic tomorrow. Manifest V3 restricts remote executable code for this reason, but static analysis still needs to look for older patterns and edge cases.

The detector reports script elements with external sources, runtime importScripts calls, eval, Function constructors and string-based timers. Each finding carries file, line, severity and confidence.

Evaluating the evidence

Read the surrounding code. A URL in a string may be unused, used only in an optional feature, or loaded in a page context where extension rules differ. A finding with a file and line is a starting point for review.

Check whether the remote host is controlled by the publisher and whether the loaded file can be replaced independently. Look for integrity checks, pinned versions or a documented update mechanism.

Limits and false positives

Bundled frameworks often contain eval-like code paths that are never called by the extension. Minified code can obscure intent. Conversely, code assembled from package assets or generated at runtime may not be detected.

Do not treat a single finding as proof of malicious behavior. Use the report alongside publisher transparency, store review status and runtime observation where appropriate.

Frequently asked questions

What counts as remote code in an extension?

Executable JavaScript delivered from outside the extension package. It can arrive through script tags, importScripts, dynamic imports, eval or a remote configuration that is executed.

Is eval always malicious?

No. Build tools, template engines and legacy libraries use eval-like patterns. Context and reachability determine whether it is a real concern.

Does Manifest V3 block remote code completely?

It restricts remote executable code and tightens CSP, but extensions can still load data, and the rules have exceptions. Static review remains useful.

Can the detector inspect code loaded at runtime?

No. It only sees files in the package you upload. Runtime code must be observed with browser developer tools or network monitoring.

Last reviewed: October 31, 2026

Or analyze from a store URL