Browser extension is same problem but smaller. The .crx file is just a zip, so anyone can open it. But almost everything in the store is bundled and minified. You can read it, but you are reading the output of a build you did not run.

So I made mine with no build step at all. The files in the repo are the files that run. Reason is simple. My extension reads cookies, and I could not find other way to let someone confirm that the thing reading their cookies is the thing I published. Unzip the crx, diff with repo, 10 seconds.

Cost is real. No modules, no types, and I had to write some things in a stupid way. It was acceptable because the code is small. For a big project this is not possible, so the work in this article is important.