Individual users and small teams have no affordable automated tool to audit their installed Chrome extensions for security risk

CRXcavator, the free automated Chrome extension security scanner built by Cisco/Duo, was quietly killed in 2023 with no replacement and no migration path. The only remaining option is Spin.AI at $5,000+/yr with enterprise minimums. Individual users and SMBs installing 20-40 extensions each have no affordable automated way to check for ownership transfers, permission scope creep, code hash mismatches, or known-bad network domains. The gap is acute: in 2025-2026, supply-chain attacks against extensions hit 2.3 million users (RedDirection), 4.3 million users (ShadyPanda), and 900,000 users (AI chat theft via Google-Featured extensions). Users have no tool to scan their own extension inventory against these patterns. Manual review takes 15-30 minutes per extension.