XPI Analyzer — Firefox扩展安全扫描器

一款命令行工具，用于分析Firefox扩展文件（.xpi），检测恶意软件、混淆、隐藏载荷、隐写术以及其他用于绕过扩展审查团队的恶意代码技术。

功能概述

extension-scanner.py 会解压Firefox扩展，并对其内部每个文件执行一系列安全检查，最终生成一份按严重性分级、带有颜色编码的报告。

如何使用本扫描器在Firefox/Mozilla扩展商店中实时发现恶意软件并进行深入分析 – 指南/教程

执行的检查项

类别	检查内容
权限	危险或过于宽泛的权限（`nativeMessaging`、`<all_urls>`、`debugger`、`desktopCapture`等）
内容安全策略	`unsafe-inline`、`unsafe-eval`、CSP中的远程脚本源
JavaScript混淆	`eval()`、`atob()`、`Function()`构造函数滥用、十六进制转义序列、split/join/reverse重组、编码字符串字面量、带字符串参数的`setTimeout`
可疑URL	硬编码的外部域名，分类为已知恶意（命中黑名单 → HIGH）、未知（未在白名单中 → MEDIUM）、已知安全（白名单中 → 抑制）。运行`--update-blocklist`可从URLhaus和Peter Lowe的列表刷新域名黑名单。
凭据与密钥	硬编码的API密钥、令牌（AWS、GitHub、Slack、Google）、密码、私钥和IP地址
Base64载荷	解码嵌入的base64数据块，并扫描其中是否包含可执行文件、脚本和网络代码
PNG隐写	检测PNG `IEND`后追加的数据，并自动解码尾部（base64、zlib、gzip及其组合）；解码后的载荷会递归扫描JavaScript混淆、凭据和可疑URL。同时检测未知数据块类型、LSB通道异常以及异常高的像素熵
文件元数据	魔数检测可执行文件（`.exe`、`.elf`、`.dylib`）、双扩展名（如`photo.png.js`）、可疑文件名（`keylog`、`miner`、`wallet`）
多格式文件	同时有效于两种格式的文件（如HTML + ZIP）
ZIP技巧	路径遍历条目、文件名中的空字节、可能欺骗解析器的重复条目、携带载荷的ZIP注释
远程代码	从远程URL加载的后台页面或Service Worker
高熵	熵值异常高的文件或字符串字面量（很可能是加密或压缩的载荷）
API滥用	浏览器扩展API调用，指示数据窃取或外泄：`cookies.getAll({})`、`tabs.query({})`、`history.search`、键盘监听器、剪贴板读取、`scripting.executeScript`带动态函数。当数据收集调用与出站网络发送在同一文件中成对出现时，升级为CRITICAL。
隐藏元素	动态创建的不可见iframe（`display:none`、零尺寸）注入到DOM中——静默的联盟营销ping或C2通道。通过`new Image().src`指向外部URL的追踪像素。
定时炸弹	`setTimeout`/`setInterval`延迟≥5分钟；`Date.now()`算术门控；`localStorage`安装日期检查，在首次运行数天后激活行为；`Math.random()`阈值门控，仅在部分页面加载时触发。
反分析	`navigator.webdriver`检查；零宽/高窗口比较；裸`debugger`语句；`performance.now()`算术用于基于计时的沙箱检测。

严重性级别

CRITICAL — 几乎肯定为恶意；需立即调查
HIGH — 高度可疑；需仔细审查
MEDIUM — 存在潜在风险；需结合上下文审查
LOW — 轻微问题；仅供参考
INFO — 元数据（哈希、文件大小等）

安装

前置依赖包

Python 3.10+ 是必需的。python3.11、python3.12或python3.13
**python3-venv** — 如果使用虚拟环境，则为必需

使用虚拟环境：

sudo apt install python3 python3-venv
git clone https://github.com/ernos/extension-scanner.git
cd extension-scanner

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

可选包

**python3-numpy** — 推荐用于隐写分析，系统级安装（否则使用pip install -r requirements.txt）
pillow：推荐用于隐写分析
numpy：推荐用于隐写分析
```bash
pip install pillow numpy
#Ubuntu系统级安装：
sudo apt install python3-pillow python3-numpy

git clone https://github.com/ernos/extension-scanner.git
cd extension-scanner
chmod +x extension-scanner.py
mkdir -p ~/.local/share/bin
ln -s $PWD/extension-scanner.py ~/.local/share/bin/extension-scanner


# 用于LSB隐写分析（可选但推荐）
pip install pillow numpy

# 选项1. 仅当前用户：
# 启用bash补全，简化使用（TAB自动补全命令）
mkdir -p ~/.local/share/bash-completion/completions
cp extension-scanner-completions ~/.local/share/bash-completion/completions
echo "source ~/.local/share/bash-completion/completions/extension-scanner-completions" >> ~/.bashrc

# 选项2. 为所有用户全局启用补全（应从.bashrc自动加载）
cp extension-scanner-completions /usr/share/bash-completion/completions

如果未安装Pillow/NumPy，工具仍可运行——仅跳过LSB和像素熵检查，并打印一条警告信息。

用法

usage: xpiscanner [-h] [--update-blocklist] [--min-severity {CRITICAL,HIGH,MEDIUM,LOW,INFO}] [--json] [--compact] [-v] [-m] [--scans CHECK [CHECK ...]]
                  [targets ...]

Firefox Extension Scanner - Scans XPI files for security risks and malware indicators

positional arguments:
  targets               One or more XPI files or directories containing XPIs to analyze

options:
  -h, --help            show this help message and exit
  --update-blocklist, --update, -u
                        Fetch fresh domain blocklists from URLhaus and Peter Lowe's list, merge with the bundled snapshot, and saves to
                        /home/peb/projects/Firefox-Extensions/extension-scanner/blocklist.json. Exits after updating.
  --min-severity {CRITICAL,HIGH,MEDIUM,LOW,INFO}
                        Minimum severity to display (CRITICAL, HIGH, MEDIUM, LOW, INFO; default: INFO)
  --json                Output results as JSON instead of formatted text
  --compact, -c         Print each finding on 1-2 lines instead of the default 3-line format
  -v, --verbose         Enable verbose output: show additional context for findings
  -m, --manifest        Show full extension manifest for each target
  --scans, -s CHECK [CHECK ...]
                        Limit analysis to specific check types. Choices: anti-analysis, api-abuse, credentials, cross-file,
                        file-meta, hidden-elements, obfuscation, payloads, permissions, polyglot, remote-code,
                        signatures, steganography, time-bomb, zip-tricks. Omit to run all checks (default).

    extension-scanner.py — Analyze Firefox (and other browsers) extension XPI files for security risks and malware indicators.

    Read README.md for information on how to interpret findings, limitations, and best practices for use.  
    This tool is intended for security researchers, analysts, and advanced users who want to perform a 
    comprehensive static analysis of browser extensions. It should work well for other browsers as well, 
    but this has only been tested on firefox.

Usage:
    python3 extension-scanner.py [OPTIONS] targets...

Targets can be individual .xpi files or directories containing .xpi files. Use glob patterns (e.g. *.xpi) for convenience.

Available check types:
    permissions               Dangerous/broad manifest permissions and CSP issues
    remote-code               Background pages or service workers loaded from remote URLs
    obfuscation               eval/atob/encoding tricks, suspicious URLs, high-entropy strings
    payloads                  Base64-encoded blobs decoded and scanned for executables/scripts
    steganography             PNG appended data (auto-decoded via base64/zlib/gzip), unknown chunks, LSB channel analysis
    credentials               Hardcoded API keys, tokens, passwords, private keys, IP addresses
    file-meta                 Magic bytes, double extensions, suspicious filenames, file entropy
    polyglot                  Files valid in two formats simultaneously (e.g. HTML+ZIP)
    zip-tricks                Path traversal, null bytes, duplicate entries, ZIP comments
    cross-file                HTML class tokens cross-referenced against JS localStorage keys
    signatures                Known strings from confirmed malicious extension families (qingcaila, YTMP4, etc.)
    api-abuse                 Browser API calls indicating data theft or exfiltration (cookies, tabs, history, keylogger, clipboard, executeScript)
    hidden-elements           Invisible iframes, zero-dimension element injection, tracking pixels (new Image().src)
    time-bomb                 Long-delay setTimeout, Date.now() gates, localStorage install-date checks, Math.random() gates
    anti-analysis             navigator.webdriver, zero-size window, bare debugger statement, performance.now() timing

最受欢迎

browser-xpi-malware-scanner