Security News "Particle" Chrome Extension Sold to New Dev Who Immediately Turns It Into Adware

[LASER_oneXM]

A company is going around buying abandoned Chrome extensions from their original developers and converting these add-ons into adware.

This scheme came to light two days ago when the users of a popular Chrome extension began complaining about an update that requested two intrusive permissions that the extension never used, or would have never had a reason to. The two permissions are:

• Read and change data on (all) websites visited
• Manage apps, extensions, and themes

The Chrome extension in question is named Particle (formerly known as YouTube+) and is a simple tool that allows users to change the UI and behavior of some of YouTube's standard features.

Extension sold to new developer
Somewhere between May and two days ago (July 11), the original author was approached by a company that offered to buy the extension from him for a price of his choosing.
....
....
....
After the Particle code had changed hands, two days ago, the new owner released a Particle update through the Chrome Web Store.

Immediately, users noticed the extension's new permissions and flocked to the original author's GitHub repo to complain about the update, only to discover that the extension changed devs without any warning to existing users.

 

[shukla44]

This is not a shocking matter but sure is concerning.
I am wondering if this is true for firefox particle addon also Only Chrome extension was sold (I checked). I use youtube+ on firefox not on chrome & there hasn't been any new updates released for it on FF.

Thanks for the info.
Regards.

 

[Hadden]

Never used, but it's quite sad. And risky.
One day you use a great extension, then a browser hijacker.
I had few adware extensions, and they were annoying.