Day 435: Google Took Down My Chrome Extension for Using Lodash

👋🏽 Hello From Google

So there I was, happily closing out some tabs before heading to bed, when I noticed a new email from the Chrome Web Store at 12:30am:

I went to Intention’s landing page and clicked on the install link, hoping against the obvious.

Google had taken down my extension with zero prior notice. I guess I wouldn’t be going to bed after all.

👶🏻 My Baby Is Dead

For the last year and a half, I’ve been building browser extensions full-time as an independent developer. At this point, I’ve invested thousands of hours in the platform because I love the power of extensions to give users control of their browsing experience. The theme around my tools has been to help people spend their time and attention well:

• 🤖 Browserflow (in private beta): No-code tool to automate workflows on any website
• 👍🏽 Hide Likes: Hide likes and other vanity metrics from social media sites
• 🙈 Hide Feed: Hide feeds/inbox by default to get things done without getting distracted
• (Bonus for developers: I made an extension starter kit to easily start new projects.)

Intention is by far the most successful of these. It got a stellar reception when it launched on Hacker News nearly a year ago, and the reviews for the Firefox version show how much people appreciate it:

(I’d show you the Chrome reviews, too, but I can’t because, well, they’re gone.)

Mozilla even featured Intention on its add-ons home page from October to January as part of its Promoted Add-ons pilot program after performing a thorough security review:

After investing so much time and effort into building something valuable, I’m still kind of in disbelief that it’s just… gone.

🕵🏻‍♂️ Investigating My Crimes

As you can see from the screenshot above, Intention was last updated a month ago, so the takedown wasn’t triggered by any recent changes I made to the code.

I looked at the cited violations and saw that Google didn’t like how some of my code looked:

I thought this might be due to my build process. When packaging Intention for production, I use webpack to minify my code to reduce the file size and also ensure that someone can’t just rip off my code and publish a clone bundled with malware. (It happens more often than you’d think.) Minifying code shouldn’t be a problem though, as it’s allowed by Google’s policies:

The code snippets didn’t look like minification though. What were these weird strings?

I copied the bit that was common in the last two snippets (\\xac\\xb1\\xd7) and searched my build output:

Found it!

The string was coming from Lodash. For those of you who don’t sling web code all day, Lodash is one of the most popular Javascript utility libraries out there. (The npm package was downloaded over 46 million times this past week, and the package on the jsDelivr CDN was served over 247 million times this past month. It’s very common.)

Searching for the string on GitHub revealed that Lodash’s source explicitly declares Unicode characters in order to implement a utility function that splits Unicode strings by their words:

In other words, this had nothing to do with code obfuscation or minification. My extension would still include the violating strings even if it were published without processing the source code in any way, simply because Lodash explicitly declares Unicode characters.

Here’s the takeaway:

If you use Lodash, one of the most popular Javascript utility libraries out there, Google can take your extension down with zero warning for “obfuscating code”.

💀 Waiting for Godot

Now, if you’ll recall the original email I received, there was a promising little section at the bottom:

This takedown was clearly a mistake. I clicked on the “Support Page” link, explained why using Lodash doesn’t mean I’m trying to “employ deceptive methods to market to users or to gather a user base”, and hit send.

As of this writing, it’s been over 14 hours since I submitted that form, and I’ve received no response. Meanwhile, I already have confused people messaging me trying to find out how to install Intention:

I’ve seen enough of these stories play out to know that I’d have a better chance waiting for the Singularity to upload all of our consciousness to the cloud to experience cosmic bliss for all of eternity than have Google’s customer support save the day. It doesn’t matter that I used to work at Google — before the eyes of G, we are all sinners.

As an independent developer, the best chance I have is to share this story with the hope that it’ll get enough attention for the right person to do something about it. I’d really appreciate if you could share this post online so that this can be resolved. Thank you!!!

🤔 Final Thoughts

On one hand, I’m glad that Google is making more of an effort to crack down on malicious extensions. The Chrome extension ecosystem has historically been a cesspool of malware guzzling up users’ data, and I’ve written before about how things like the permissions system are broken. With changes like Manifest V3 and transparent privacy practices, the Chrome team is clearly trying to improve the situation. I may not agree with all of their decisions, but their efforts are still very much appreciated.

On the other hand, having countless hours of work be obliterated by an automated system without manual review is terrifying. Requiring developers to clarify anything suspicious within a certain timeframe or risk being removed would be fine (this is what Mozilla does); taking everything down with zero warning is not.

For the past 9 months, I’ve been working full-time on a new extension called Browserflow that helps people save lots of time by automating workflows on any website. I’ve been incredibly excited about launching it and building a sustainable business on it, but now I’m not sure how much to re-evaluate based on this today’s incident. Is this a temporary growing pain for a much-improved extension ecosystem? Or is it a sign that continuing to invest in a platform where everything can suddenly disappear is a really dumb idea?