Unused assets and dead code excluded from production build
Why it matters
Unused assets and dead code bundled into a production extension inflate the download size every user pays on install and update, slow popup initialization as JavaScript is parsed, and expose development-only test fixtures or debug data that could leak internal implementation details. ISO 25010:2011 performance-efficiency.resource-utilisation applies: every unreferenced file is pure overhead. Source maps included in packaged extensions additionally expose original source code to any user who inspects the .crx.
Severity rationale
Low because unused assets inflate bundle size and can expose internal paths, but do not directly break functionality or create immediate security risk.
Remediation
Configure your bundler to exclude source maps, screenshots, and test fixtures from the production copy, and verify all remaining assets are referenced in manifest.json or code.
// webpack.config.js — exclude development artifacts from production
const CopyPlugin = require('copy-webpack-plugin');
module.exports = {
devtool: false,
plugins: [
new CopyPlugin({
patterns: [{
from: 'public',
globOptions: {
ignore: ['**/*.map', '**/screenshots/**', '**/test-fixtures/**'],
},
}],
}),
],
};
After building, run find dist/ -type f | sort -k1 -t/ | xargs ls -lh and cross-reference every file against manifest.json icon declarations and HTML <script>/<link> tags. Remove anything with no reference.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension UX & Performance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency.resource-utilization
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-ux-performance·automated