A developer crawled the entire Firefox add-on catalogue (96,532 extensions) and found that while 74% declare an open source license, only 18,734 of those actually link to a public repository. The most common license (MPL-2.0, 36,342 extensions) is the AMO submission form's default, meaning most declarations are accidental. In response, the author built ffext, a tool that lists only extensions with verifiable source links and ranks them by source availability, permission footprint, data collection disclosure, maintenance recency, and adoption — capping popularity's influence to prevent it from dominating results. Key limitations include snapshot data (no re-crawl schedule), self-declared permissions and data collection, and repository detection limited to eight known forges.
Questions this post answers
What percentage of Firefox extensions on AMO that claim an open source license actually link to their source code?
Only about 26% do. Of 71,433 Firefox extensions carrying an OSI/FSF license on AMO, just 18,734 link a public repository. The most common license, MPL-2.0, accounts for 36,342 extensions and is the default pre-selected option in AMO's submission form — meaning most declarations reflect an unchanged dropdown rather than a deliberate choice. Developers auditing browser extension supply chains track findings like these on daily.dev.
How does ffext rank Firefox extensions differently from AMO's default sorting?
ffext scores extensions on five components: source availability, permission footprint, data collection disclosure, maintenance recency, and adoption. Popularity is capped at a log-scaled 9 out of 100 so it cannot dominate rankings. Star ratings are Bayesian-adjusted toward the corpus mean (4.16) because the median rated extension has only two ratings, making raw averages unreliable noise. Developers choosing extensions for security-sensitive environments find tool comparisons like this on daily.dev.