Manifest V3 forbids remotely hosted code, and the review reads your package without running it: a script address on another host is a violation wherever it stands, even in a branch of a bundled library your extension never calls. mv3-remote-code-check reads the built extension the same way and fails your build first.
$ npx mv3-remote-code-check dist dist: 2 reference(s) to remotely hosted code, which Manifest V3 forbids chunks/vendor-pdf.js:1:48213 https://cdnjs.cloudflare.com/ajax/libs/pdfobject/2.1.1/pdfobject.min.js (address on a script CDN) vendor/tesseract/worker.min.js:2:92596 https://cdn.jsdelivr.net/npm/@tesseract.js-data/ (address on a script CDN) $ npx mv3-remote-code-check universal-file-converter-v1.2.2.zip universal-file-converter-v1.2.2.zip: no remotely hosted code in 34 files
Universal File Converter 1.1.3 was rejected ("Blue Argon") for jsPDF's PDFObject address on cdnjs, in an output mode the extension never used. tesseract.js carries the same kind of address in its default worker, core and language paths. A rejection costs days of review; this check costs a second.
A built folder, the .zip you upload or a .crx: code, markup, styles and the manifest's content
security policy, with the file, line and column of each finding.
Calls to an API, Google Fonts stylesheets and credit links to a source page on GitHub are not code and are not reported. Checked against four extensions published on the Chrome Web Store: all clean.
The Vite / Rollup plugin takes script-CDN addresses out of every chunk while you build, then reads the whole output folder, files copied by other plugins included, and fails the build on anything left.
cdn-address |
Any address on a script CDN (cdnjs, jsDelivr, unpkg, esm.sh, Skypack, jspm, …), whatever its ending. |
|---|---|
remote-script-file |
A .js, .mjs or .wasm file on any other host, with or without a scheme or a query.
|
script-tag |
A <script src> naming another host, or one whose address is built at run time.
|
manifest-csp |
content_security_policy.extension_pages allowing a script source outside the package, or
'unsafe-eval'.
|
Point the action at the built folder or the Store ZIP. Findings appear as annotations and in the job summary; the action needs only the runner's Node.js.
- run: npm run build
- uses: vannt-dev/mv3-remote-code-check@v0
with:
path: dist # or the .zip you upload; one path a line
exclude: '**/*.map' # optional
allow: | # optional, findings to leave out
https://example.com/known.js
import { remoteCodeGuard } from 'mv3-remote-code-check/vite';
export default defineConfig({
plugins: [
// ...plugins that copy workers, wasm or vendored scripts
remoteCodeGuard(), // last, so its check sees what the others wrote
],
});
Node.js 22.18 or newer. No runtime dependencies.
$ npx mv3-remote-code-check dist $ npx mv3-remote-code-check my-extension-1.2.0.zip --format json $ npx mv3-remote-code-check dist --format github --summary "$GITHUB_STEP_SUMMARY" $ npm install -D mv3-remote-code-check # for the Vite plugin and the API