Someone offered to buy my extension

What these offers look like

• A short, friendly email or a message through the store's contact link, often from a free email address or a company with no history.
• An offer to buy the extension outright, usually priced per user, and paid in crypto, PayPal or a wire to an unrelated company.
• Or an offer to "monetize" it: you keep the extension and add their SDK or script, and they pay you a monthly amount per active user.
• A request to transfer the item to their developer account, or to add them to your account, so they can publish updates.

Why they want it

• Your users trust you, and Chrome installs updates silently. A buyer gets every permission you were granted, and the next update reaches all your users without asking them.
• Extensions that can read every page are worth the most. Buyers use them for affiliate link injection, ad injection, selling browsing data, or stealing passwords and crypto wallets.
• In 2026, one campaign bought five established extensions from their developers and turned them into wallet and password stealers. See the incidents page for the details.

Red flags

• They don't say what they will do with the extension, or the plan is vague ("grow it", "integrate our technology").
• The SDK is closed source, loads code from their server at run time, or needs permissions your extension doesn't have yet.
• They pay more per user than any honest use of your users could earn.
• They want the deal kept quiet, or want your name to stay on the listing after the sale.

If you do want to sell

• Selling is legitimate, and many good extensions change hands. Ask for the buyer's real name, company, other products and a written plan for the extension.
• Tell your users before the transfer: in the description, in a release note, or in the extension itself. People can then decide whether to stay.
• Check that the new owner will keep the privacy policy and the store's data disclosures accurate after the change.
• Never add code you haven't read. If you open-sourced the extension, the buyer can't hide changes from people who check.

Real cases

The incidents page lists published reports of extensions that turned malicious, including ones that were bought from their developers. The popular extensions report shows how many widely used extensions can read every page, which is what buyers look for.

Received an offer and want to share it? Open an issue on GitHub (remove anything private). Real examples help other developers recognise these offers.