If you इस्तेमाल the JSON Formatter Chrome extension, uninstall it now और keep reading. In early अप्रैल 2026, users started noticing the extension had started injecting ads, hijacking checkout pages के साथ donation prompts, और adding tracking scripts to their browsers. The extension — which has millions of हफ़्ताly users — had been बेचा या co-opted, और a भरोसेमंद dev tool became adware overnight.
क्या Actually Happened
A user on Hacker नयाs (jkl5xx) flagged it first: a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa appeared in the Chrome inspector. Hours later, another user got a Malwarebytes quarantine alert specifically for JSON Formatter. The full HN thread has 136 comments of developers confirming the pattern और debating what happened.
The mechanism is textbook:
- Popular free extension gets millions of installs over साल.
- Original author gets "approached दो बार to add a search और tracking script" (HN user
nipdescribes the direct pitch). - At some point, someone says yes — या the extension is बेचा to someone who will.
- A routine auto-update pushes the monetization code. Your browser trusts the update. Adware is now running के साथ your extension's permissions.
This isn't new. The Hacker नयाs covered a breach on JSON Formatter's website back in November 2025. The pattern repeats क्योंकि browser extensions are the softest attack surface in the entire developer toolchain.
The Actually-Safe Alternatives
If you format JSON more than दो बार a हफ़्ता, you ज़रूरत a tool that lives outside the browser-extension threat model. Here are three categories of replacement, ranked by how much of the risk हर one removes.
1. A Client-Side Web App Best · $0 – $9
A web app that चलती है entirely in your browser — no backend, no data भेजा to a server. Opening it feels identical to using an extension, लेकिन the attack surface is exactly the one tab you're looking at. No auto-updater. No OAuth scope. No permissions on other tabs.
Septim Forge is one option (built by us, disclosed): 22 developer utilities — JSON formatter, JWT decoder, diff checker, SQL formatter, CSV↔JSON, regex tester, UUID, hashes — सभी running client-side के साथ zero server calls. 16 tools are free, 6 Pro tools are $9 once, lifetime. Your data कभी नहीं leaves the page.
Wes Bos also shipped JSON Alexander as a response to वही incident. Different philosophy (extension, लेकिन a new clean one), similar privacy stance.
Key question to ask of any client-side web tool: open DevTools → Network tab → paste JSON → does anything outbound fire? If yes, it's नहीं दरअसल client-side.
2. A Self-Hosted Tool Most-paranoid · $0
If you're सच में allergic to trusting anyone, चलती हैं a local formatter. jq has been the CLI standard for साल. For GUI, json-viewer as a local npm package या json-lite as a desktop app both work. Trade-off: setup friction, और you now own the security-patching responsibility.
यह है the right call अगर your org prohibits sending code/data to any external endpoint, period.
3. A नया Extension (Cautiously) If you insist · varies
If you सच में चाहिए the keyboard-shortcut convenience of an extension, switch to one that has (a) open source on GitHub you can audit, (b) fewer than 5 permissions requested, (c) active maintenance by a named developer के साथ a verifiable presence.
Downside: this exact pattern happens हर couple of साल. The new safe extension may be the अगला adware victim in 2028.
कैसे Spot the Next One Early
The JSON Formatter incident isn't a one-off. Extension monetization is a well-trodden path now. Here are the early-warning signs a भरोसेमंद dev extension has been compromised:
- A routine update adds new permissions. If Chrome asks you to approve "read data on सभी websites" during an auto-update of a tool that previously didn't ज़रूरत that, uninstall immediately. The extension is being repurposed.
- Unexpected network requests appear in DevTools. A client-side JSON formatter should make zero network calls after the initial page load. If you see XHR traffic during formatting, something's exfiltrating.
- The extension asks for donations on pages unrelated to itself. Legitimate donation prompts live in the extension's own UI. Prompts injected into your bank's checkout page are adware — no exceptions.
- नया UI elements appear where they weren't before. Check
document.querySelectorAll('[id*="give-freely"], [id*="donate"], [id*="tracking"]')on any page your extension touches. If the extension injected DOM nodes there, investigate. - Malwarebytes, uBlock, या PiHole suddenly flags something. These tools have low false-positive rates for installed extensions. Take the warning seriously even अगर you trust the extension.
The Bigger Pattern
Every "free" dev tool that survives long enough faces the monetization question. The honest ones charge. The dishonest ones बेचना tracking.
There's a reason तो many developers are migrating back to paid tools — नहीं क्योंकि they're better, लेकिन क्योंकि the business model is legible. $9 एक बार for a tool के साथ कोई subscription नहीं और no ads is easier to reason about than "free" के साथ an adtech backdoor waiting to activate.
The price of "free" in the dev tool market is almost हमेशा "you get monetized eventually." The dishonest version is adware. The honest version is a SaaS subscription. The rare version is one-time payment के साथ no strings.
Checklist: Uninstall, Replace, Move On
- Go to
chrome://extensions. Remove "JSON Formatter" अगर अभी भी installed. - Clear your browser cache और cookies for any site the extension may have injected into.
- Rotate any auth tokens, API keys, या credentials that may have been pasted into JSON being formatted by the extension in the आख़िरी 30 दिन. यह है paranoid लेकिन cheap.
- Pick a replacement from section 2 above और bookmark it.
- Set a calendar reminder for 6 महीने from now to check that your replacement hasn't drifted. Audit it के साथ DevTools at that time.
Septim Forge — 22 dev tools, सभी client-side
Free forever. $9 एक बार unlocks Pro: Diff Checker, SQL Formatter, CSV↔JSON, JSON→TypeScript, Code Minifier, और advanced tools. No server calls. No data collection. No extension — it's a web app, तो the adware attack path physically cannot apply.
Try Septim Forge Free →If you're browser-tool refugee: Septim Vault is a client-side encrypted vault for dev secrets (API keys, tokens, .env values) बनाया on वही no-server principle. Tonight only: Vault + Drills (25 Claude Code skills) bundled for $39. septimlabs.com/tonight · expires midnight ET.
Until the browser extension permission model fundamentally changes, this will keep happening. The JSON Formatter incident is a reminder that हर dev tool you trust is one auto-update away from an adversarial role. Pick tools where the trust model is legible — client-side, open source, या paid by someone who doesn't ज़रूरत to बेचना your data.
— The Septim Labs team