chrome-plugin-artifacts

Parses the Chrome browser's manifest.json file and retrieves extension information. The command converts the extension name, version, description, required permissions, update URL, and other data into structured fields.

Command properties

Item	Description
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

chrome-plugin-artifacts [zippath=STR] [zipcharset=STR] FILE_PATH

Options

zippath=STR: Path to the ZIP file containing the manifest.json file. Use this option to query a manifest.json file inside a ZIP archive.
zipcharset=STR: Character set for ZIP file entries. Default: utf-8

Target

FILE_PATH: Path to the Chrome extension's manifest.json file. Use a wildcard (*) to specify multiple files. This file is typically located at C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\Extensions\<extension_id>\<version>\manifest.json.

Output fields

Field	Type	Description
`name`	string	Extension name
`version`	string	Extension version
`description`	string	Extension description
`minimum_browser_version`	string	Minimum browser version required by the extension
`permissions`	array	List of permissions required by the extension (for example: `alarms`, `storage`)
`update_url`	string	Extension update URL
`optional_permissions`	array	List of optional permissions
`file_ctime`	timestamp	Creation time of the manifest.json file
`file_mtime`	timestamp	Modification time of the manifest.json file
`file_atime`	timestamp	Access time of the manifest.json file

In addition to the fields listed above, all key-value pairs in the manifest.json file are assigned as output fields. Depending on the extension, additional fields such as manifest_version, key, icons, background, content_security_policy, and default_locale may appear.

Error codes

Parse errors

N/A

Runtime errors

N/A

Description

The chrome-plugin-artifacts command parses a Chrome extension's manifest.json file as JSON and assigns all key-value pairs as output fields.

The minimum_chrome_version key in the original JSON is renamed to minimum_browser_version in the output.

The creation, modification, and access times of the file are assigned to the file_ctime, file_mtime, and file_atime fields respectively. When the zippath option is used, the ZIP entry timestamps are used; otherwise, the file system timestamps are used.

If JSON parsing fails, the file is skipped and processing continues with the next file.

To query a manifest.json file inside a ZIP archive, specify the ZIP file path in the zippath option and the path inside the ZIP as the target.

Examples

Querying a Chrome extension manifest

chrome-plugin-artifacts /opt/logpresso/evidence/Extensions/ghbmnnjooekpmoecnnnilnnbdlolhkhi/1.53.0_0/manifest.json

Retrieves extension information from the manifest.json file at the specified path.

Querying all extensions with a wildcard
```
chrome-plugin-artifacts /opt/logpresso/evidence/Extensions/*/manifest.json
```
Retrieves all extension manifest files at once.

Querying a manifest inside a ZIP archive

chrome-plugin-artifacts zippath=/opt/logpresso/evidence/artifacts.zip Extensions/ghbmnnjooekpmoecnnnilnnbdlolhkhi/1.53.0_0/manifest.json

Retrieves extension information from the manifest.json file inside a ZIP archive.

Filtering extensions that require a specific permission

chrome-plugin-artifacts /opt/logpresso/evidence/Extensions/*/manifest.json
| search contains(strjoin(",", permissions), "webRequest")

Filters only extensions that require the webRequest permission.