crxray

git clone for Chrome Web Store extensions. Paste a store link or ID — get the full unpacked source on disk.

Every open-source repo has a GitHub URL you can clone. Chrome extensions don't — the Web Store is a walled garden with no download button. crxray is the missing clone command: one line, full source tree, ready to read in your editor.

How to

1. Clone extension source (store URL)

npx crxray "https://chromewebstore.google.com/detail/study-buddy/pifapfmbofjgaenkhhipjhfacfmmhkcp"

Quote store URLs. A bare URL with ? or & makes zsh fail with zsh: no matches found.

2. Clone by extension ID

npx crxray pifapfmbofjgaenkhhipjhfacfmmhkcp

3. Clone + security audit

npx crxray pifapfmbofjgaenkhhipjhfacfmmhkcp --audit

4. Clone + readable source (deobfuscate + beautify + audit)

npx crxray pifapfmbofjgaenkhhipjhfacfmmhkcp --deobfuscate --beautify --audit

That's it. You get a folder with manifest.json, background scripts, content scripts, popup HTML, assets — everything the extension ships with. Grep it, diff it, hand it to an AI agent.

Zero install. Node 18+.

Why not just use a website?

| | Web downloaders | crxray | |---|----------------|------------| | Input | Paste in browser | npx crxray <url-or-id> in terminal | | Output | View online / download zip | Full folder on disk — like a clone | | Scriptable | ❌ | ✅ --json, CI, agents | | Audit | ❌ | ✅ --audit risk report | | Readable JS | ❌ | ✅ --deobfuscate --beautify | | Diff versions | ❌ | ✅ crxray diff | | Open source | varies | ✅ MIT |

Alternatives

These are great if you want source in the browser, once:

• extensioncode.app — paste a store link, browse source online
• showmecode.dev — view extension source in the browser
• CRX Viewer — Chrome extension for viewing CRX files

crxray is for when you want git clone-style source on disk — automated, scriptable, auditable, and agent-friendly.

Why

• Source code, instantly — the Web Store has no clone button. This is it.
• Audit before installing — extensions run with terrifying permissions. Read the code first.
• Built for AI agents — paste a store link into Cursor or Claude; the included skill handles the rest.
• Learn from the best — see how uBlock, React DevTools, or any extension is actually built.
• Rescue abandoned extensions — the author's GitHub is gone but the store listing isn't.

Usage

Chrome Web Store URLs (current and legacy), Edge Add-ons URLs, or a bare 32-character extension ID.

Options

| Flag | Description | |------|-------------| | -o, --out <dir> | Output directory (default: ./<name>-<version>/) | | --store <name> | Store for bare IDs: chrome (default) or edge | | --crx-only | Save the raw .crx file, skip unpacking | | --keep-crx | Keep the .crx alongside the unpacked source | | --audit | Security audit + entry-point map (writes .crxray-audit.json) | | --map | Entry-point map and readability stats only | | --deobfuscate | Deobfuscate all JS via webcrack (optional dep, see below) | | --beautify | Beautify all JS files | | --no-maps | Delete .map source maps (default with --audit) | | --keep-maps | Keep source maps when auditing | | --json | Machine-readable output (for scripts and agents) | | -q, --quiet | Print only the output path |

Security audit

npx crxray "<url>" --audit
npx crxray audit ./unpacked-extension/

Risk score, permission tiers, suspicious patterns, network endpoints, start here file list. Writes .crxray-audit.json.

Diff two versions

npx crxray diff ./old-unpacked ./new-unpacked
npx crxray diff "<url-a>" "<url-b>"

Permission changes, added/removed/modified files, new endpoints in changed JS.

Use with AI agents

mkdir -p ~/.cursor/skills && cp -r skill/crxray ~/.cursor/skills/

Then ask: "Is this extension safe? https://chromewebstore.google.com/detail/..."

Or tell any agent:

Run npx -y crxray <store-url> --audit --deobfuscate --beautify --json, then read outDir and .crxray-audit.json.

Programmatic API

import { crxray } from 'crxray';

const { outDir, summary } = await crxray(
  'https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm'
);

How it works

1. Parse the extension ID from the store URL.
2. Download the .crx from the browser's public update endpoint (same bytes the store serves).
3. Strip the CRX header and unpack the ZIP (zip-slip protected).
4. Summarize the manifest — permissions, host access, content scripts, i18n names resolved.

Legal note

Downloads from the stores' public endpoints — the same ones your browser hits on every update check. Unpacked code belongs to its authors. Inspect, audit, and learn — don't redistribute.

License

MIT

Troubleshooting

zsh: no matches found: https://...

zsh expands ? and * as globs and treats & as "run in background", so an unquoted store URL never reaches crxray. Quote it, or pass the bare extension ID:

npx crxray "https://chromewebstore.google.com/detail/name/abcdefghijklmnop?hl=en"
npx crxray abcdefghijklmnop

--deobfuscate says webcrack is not installed

--deobfuscate uses webcrack, which depends on the native isolated-vm addon. isolated-vm has no prebuilt binaries for Node 23+ and fails to compile against its V8 headers. crxray therefore declares webcrack as an optional dependency: install never fails because of it, and every other feature (--audit, --beautify, --map, diff) works without it.

To get deobfuscation, run crxray on Node 18–22 LTS:

nvm use 22
npm install -g crxray