# fransr/postMessage-tracker

A Chrome Extension to track postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon

Repository: https://github.com/fransr/postMessage-tracker
Canonical: https://ross.abutalabs.com/products/postmessage-tracker
Language: JavaScript
License: MIT
License Family: permissive
Last push: 2024-01-26T17:48:33+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3382, "days_push": 950, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1335, forks 187 (observed 2026-08-28T04:04:25.248862+00:00)

## What it is
A Chrome extension that tracks postMessage listener usage across a page and its subframes, showing listener counts via the extension icon and logging URL, domain, and stack traces. It unpacks common wrappers (Raven, New Relic, Rollbar, Bugsnag, jQuery) and can send logs to a configurable endpoint for later review.

## Use cases
- find hidden postMessage listeners in iframes during a bug bounty
- audit which domains a page communicates with via postMessage
- debug cross-window messaging between frames
- log postMessage listener functions and stack traces to an endpoint
- bypass error-tracking wrappers to see real listeners in devtools

## When to choose
- you are doing web security research or bug bounty hunting on postMessage handlers
- you need to trace short-lived or interaction-triggered listeners across subframes

## When to avoid
- you need automated postMessage security testing in CI rather than manual browser inspection
- you use a browser other than Chrome

## Facets
- artifact type: plugin
- maturity: maintenance
- function: security, developer-tools, monitoring
- domain: security, browser-extensions, developer-tools, web-development
- platform: browser, browser-extension
- tags: postmessage, chrome-extension, penetration-testing, web-security, devtools, bug-bounty, javascript

## Member repositories
- fransr/postMessage-tracker (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:25.248862+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:44:22.157402+00:00, confidence not recorded.
  - readme: https://github.com/fransr/postMessage-tracker (fetched 2026-08-28T04:04:25.248862+00:00, sha 16c7610b31e5)
- Data as of 2026-08-30T08:39:29.467469+00:00.