Agent WranglersDSK-19Recommended
Protect the store accounts that publish the extension
Publish from a group or organisation account, never one person's account. Every person on it signs in with a phishing-resistant second factor, and uploads come from CI.
How to do it
An attacker who gets into a store account ships a hostile update that installs itself on every user's browser within hours. Phishing mail posing as store review is the usual way in. Chrome Web Store requires 2-step verification before you publish or update. Use passkeys or security keys, as offer second factors from strongest to weakest ranks them. Upload through the store API from a CI job, as protect the accounts that can change the code says. Opt in to Chrome's verified uploads, so the store refuses any package not signed with your own key.
How to check
Each store's member list shows at least two owners and a second factor for each. The last 10 published versions each link to a CI run. A version that no CI run made triggers an alert within 1 hour.
Sources
Related rules
- ACC-17 Offer second factors from strongest to weakest in Accounts and identity
- ENG-20 Protect the accounts that can change the code in Engineering
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/browser-extensions/extension-store-accounts">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.