What is the business model of free extensions like these? Is it all spyware/malware?
It looks like many free extensions either have malware in them from the start or get sold to malware companies later on, who then deploy the malware via updates:
Why does everything have to have a business model? Sometimes people like to create things for the sure enjoyment of creating things or they have an itch to scratch and think others might have the same need. Not everything is nefarious.
Exactly for the reason they said. The concern isn't that extensions are necessarily nefarious, but that people often want something in return for their work, which might be money by whatever means.
As is evident, what their "partner extension" does is in fact maliciously hijacking and replacing ad-space on websites visited by the user.
Strangely, searching for their name among the issues on GitHub does not show other such results. I guess they usually make contact directly and that the person at that company who filed this issue did not realize it would be visible to the public.
Here is the full text of the issue:
> Adnow is interested in byuiing your extension traffic #1
> Dear Kyong Tsu,
> My name is Anastasia, I am a manager from international advertising network Adnow.
> Extension traffic is a hot trend nowadays, and we are interested in buying traffic from Facebook Video Downloader extension and the others. We are ready to share an idea of monetization extensions with you and give you a method.
> We offer:
> * high payouts
> * 100% fill rate (we buy traffic from all over the world)