TL;DR: The developer of a Chrome extension with 2 million+ users sells the project to an unknown third party who proceeds to secretly add user tracking capabilities to the application. Mass deletions ensue, though most users are unaware they are being tracked.

Recently, I made a post about how the developer of a relatively popular ad blocker sold their project to a group of unknowns who turned it into malware. 250k+ people being exposed to malware is bad.

But it gets worse.

First, it turns out the Nano projects weren’t the only malicious ad blockers out there. While a fair amount of these apps were obviously scams, it’s absolutely crazy that at least 80 million people have been exposed to malware.

Second, I offhandedly mentioned that another extension, The Great Suspender (which has 2 million users on its own), looked like it was setting itself up to potentially be malware.

Well, you’ve seen the title, so I think you know how this is going to go.

The Great Suspender is a popular Chrome extension that automatically suspends inactive tabs after a certain period of time. Why is this important? Well, as many a meme has mentioned, Chrome uses a lot of RAM. Putting tabs on ice when you aren’t using them helps ease that burden.

The Great Suspender is an open source project. Copying from my last post, open source projects, for the unaware, are projects that are made freely available for the public to modify and distribute. You can’t take Microsoft Word’s code and use it to make a new word processor, but you can make a new extension based on The Great Suspender. While big companies have open source libraries, a lot of work is done by small teams or individuals, which is the case with TGS.

Due to the open source nature of the project, pretty much everyone who maintains it is working on it in their spare time and for free. This is a lot of work, and can put a lot of strain on someone. Which leads me to...

On June 19, the creator of TGS, after a long period of silence, announces that they will be transferring the maintainer role to a third party and have sold them the ownership rights. The reception is actually fairly neutral. Some folks ask questions, some are worried about the project being sold to a third party, but on the surface, things seem above board. The new maintainer is named, they have a GitHub account, they don’t immediately turn the extension into malware.

Note I said "on the surface", though. There’s a lot that’s...off:

• The new account has no activity at all.

• It’s a PRO account, which is unusual to say the least. You don’t need a PRO account to maintain a project (none of the maintainers had one). Not a red flag on its own, but it’s weird.

• The original creator doesn’t want to reveal any information about this 3rd party.

• The new creator doesn’t do anything for months. No community announcements, no changes, nothing. A bit odd, considering this is something they paid for.

Community members are worried (there’s also a meager attempt to regain community control of the extension), but stuff doesn’t escalate until October.

If you’ve read the previous post, I’m sure you’re noticing some...similarities...between the Nano disaster and the happenings here. A popular Chrome extension being sold with little warning or communication to an unknown, untraceable 3rd party? It seems awfully suspicious. The Great Suspender community thought so, too.

So people do some digging, and it seems some hijinks are afoot.

Turns out that the app had been stealth updated. The application was version 7.1.6 in the community GitHub repository, but was 7.1.8 on the Chrome App Store. For non-technical folks, imagine your were working on a group project on Google Docs, but one of your group members made their own copy of the file, drew a bunch of dickbutts on it, then turned it in to the professor as the group’s completed project.

People, understandably, are not happy.

People start digging into the extension’s code, trying to figure out what this new update does. There are no changelogs, and the new developer(s?) do not respond to any questions. One commenter finds evidence that the added code calls outside JavaScript. More sleuthing uncovers that the added code is related to an analytics library. This is relatively common in extensions-turned-malware, apparently.

So it’s malicious code, right?

Maybe.

Despite the new developer’s shady actions, the sum of their contributions was to add user analytics. They also added a functioning opt-out mechanism, which is not something malicious entities tend to do. So some people assume the extension is safe.

Some people.

A skeptical team of users decide to look a bit deeper into the code. Some try to argue not to jump to conclusions, but others are bitter about the whole Nano thing .

Turns out that while the changes are minimal, the extension now request permission to edit web requests. To quote Chrome itself, that’s the ability to "observe and analyze traffic and to intercept, block, or modify requests in-flight".

The Great Suspender does not need permissions to do this to function. Not in the slightest. Also, it’s super weird that the only change the new dev made from June to October was to add user tracking.

This technically isn’t malware, as the former developer points out. However, an application not being malware isn’t the same as an application being safe. Users were not notified of this change, and if you’re using TGS, you’ve automatically been opted in to this tracking.

People come to the conclusion that while the extension isn’t malware, the new maintainer seems malicious. One particularly baffling comment suggests that the new maintainer has autism. Some people do believe the extension is malware.

Most folks involved in the conversation delete the extension anyway. People generally don’t like being tracked, and they really don’t like being stealth tracked.

Probably.

If you are addicted to The Great Suspender, I suppose you could just opt-out of tracking. In my own opinion, I don’t download extensions from shady developers, and I definitely don’t download extensions that stealth add permissions willy-nilly. There are several alternatives to TGS, it’s not as if it’s the only tab suspender in the world.

The bigger picture thing though, is to be aware of what you’re downloading to your browser. A fair amount of Chrome extensions are made by individuals or small teams of people who can really screw you over if you aren’t paying attention. So if you do download an extension, check the reviews, check the change logs, see if they have a website or GitHub repository, and make sure you know what you’re downloading.

Hopefully this is the last post I make on this subject. I love open source projects, so it makes me sad that so many people are impacted by this.

3 Months Later Update: Great Suspender was removed from the Chrome web store because of malware. It is unlikely that things like credit cards were compromised, but do change your passwords/clear cookies/cache if you still had the extension.

Auto Tab Discard, Tiny Suspender, Tabs Outliner (possibly not free?) and manually installing TGS 7.1.6 (or another safe fork) are all alternative options discussed in the GitHub threads and in the comments, though at this point, I’m wary of recommending ANY Chrome extension.