← Tester Suite

🧩 Malicious & Risky Browser Extensions

BDR scans installed extensions via chrome.management — not web pages. Test each feature with the popup panel or a copy-paste snippet, and watch results on the dashboard.
PASS 0 · FAIL 0 / 0 open /bdr/agents ↗raw viewer ↗
Start here:
  1. Make sure the extension is loaded (chrome://extensions → VIYUH BDR ≥ v0.9.32). Reload (↻) if you just changed code.
  2. Open the popup: 🧩 toolbar icon → VIYUH BDR. The 🧩 Extension test (dev) panel is at the top.
  3. Open localhost:3000/bdr/agents → pick your device — this is where extension detections show (the main /bdr page is a different feed).
  4. (Optional, for live logs) open the SW console: chrome://extensions → VIYUH BDR → service worker, then ↻ reload so it attaches. Tick ⚙️ "Preserve log".
  5. Run each feature below, then mark PASS/FAIL.
⚠️ Feature #1's full inventory endpoint needs bdr-backend restarted (else /api/extensions/inventory = 404). The scan + detections work without it.
#FeatureHow to testExpectedResult
Real-extension path (optional): Load-unpacked the folders in bdr/testing/extensions/test-exts/ (risky-coupon, fake-chatgpt, clean-notes). Every Load-unpacked install is development → each fires at least the sideload signal (correct). Remove them after. NEG controls inside the inject set: Simple Notes (clean) + uBlock Origin (known-good) → stay silent.