Plugin buyout offers and data brokers asking for your code

Some scams do not want your money at all. They want what you have built, and above all the trust that comes with it. A plugin with thousands of active installations is a direct line into thousands of websites. A browser extension updates itself on every user's machine. A game's source code and its history are training data that someone will pay for. This part of our series looks at two kinds of offers that small studios and plugin authors receive: offers to buy a plugin, extension or package, and offers to buy code or data "for AI training". Neither is always a scam. Both deserve a slow, careful answer.

The first part of the series keeps the list of the scam messages we received; the data-broker case below is on it with the facts we could check.

#Why someone buys a plugin

An honest buyer wants a product with users and plans to keep developing it. A dishonest buyer wants the update channel. Whoever controls the plugin's account on the registry decides what code the next automatic update delivers to every site, and users who trusted the old author keep trusting the account.

Anchor Hosting documented how this works in practice. A portfolio of 31 WordPress plugins, built by a small team whose revenue was falling, was listed for sale on a marketplace for online businesses and bought in early 2025. A new account appeared on WordPress.org in May 2025. On 8 August 2025 an update added a backdoor, with a changelog that said only that compatibility with the latest WordPress version had been checked. The code stayed dormant for about eight months. In April 2026 it was switched on and began delivering malicious code into site configuration files, and on 7 April 2026 WordPress.org closed all 31 plugins and then forced an update that disabled the backdoor call.

Nothing in that story required the seller to do anything wrong except sell to the wrong buyer. That is why the offer itself is the moment to be careful.

#How a buyout offer usually looks

• A friendly mail about your plugin, extension or package "for further development", often naming its number of users.
• A price that is generous for a small project, sometimes with a quick close.
• Little interest in the code, the roadmap or the users, and a lot of interest in transferring the registry account or the publishing rights.
• A request to keep the sale quiet so that "users are not confused".

Our default answer to buyout offers is no. If you ever consider one, treat it as the sale of your users' trust, not of a folder of code: identify the buyer as a company in an official register, ask what they will do with the product, announce the change of ownership publicly before it happens, transfer through the registry's own ownership process and never hand over publishing credentials "for evaluation". Registries such as WordPress.org, the Chrome Web Store and Mozilla Add-ons have rules about ownership and about what an update may contain; read them before you answer.

#Data brokers asking for code

The newer variant arrived for us in October 2026 as a series of mails. A data-acquisition agent offered a few thousand for the source code of one of our three.js games together with its full version history, "for AI training". The mail was genuinely signed by its own domain, so it was not spoofed. But that domain redirected to an unrelated product, and the website of the brand it wrote for named no legal entity at all. Each answer asked for more: from the code to a licence for training, then to a "draft agreement" that would come as an attachment.

The market is real, which is what makes this hard. MIT Technology Review reported in October 2026 that AI labs and intermediaries buy code and workspace data from failed startups. A real buyer exists somewhere. The questions are whether this is one, and whether you are free to sell what they ask for.

What you may not be free to sell

• Third-party assets. Fonts, sounds, models and textures under licences that allow use in a game, not redistribution as data.
• Contributions. Code written by others under an open-source licence or under a contract that does not give you the right to sell it on.
• Player data. Anything that identifies players is personal data. Selling it for a new purpose without a lawful basis is not a business decision you can make alone.
• Secrets in the history. Old commits may contain keys, tokens or addresses that were removed later but are still in the history.

We answered once that our code is not for sale and is not shared, opened no attachment and filtered the domains. Our article on who owns the code and accounts explains why ownership needs to be clear before any transfer, and our guide to GDPR access and erasure requests shows how seriously personal data has to be handled.

#How to verify either kind of offer

1. Identify the buyer. A company name, a register entry and a VAT number that match each other and the domain. A website that names no legal entity is an answer in itself.
2. Check where the domain leads. A mail domain that redirects to an unrelated product is a mismatch worth taking seriously.
3. Ask for the purpose and the terms in writing. What will be done with the plugin or the data, who gets it, for how long and under what licence.
4. Refuse access "for evaluation". Repository access, registry credentials or a full export before a signed agreement is the whole prize.
5. Do not open "draft agreements" from unknown senders. Ask for the text in the body of the mail, or not at all.

#What to do

Say no by default. If you want to explore a sale, make it a slow, documented business decision with your users and your licences in mind, not a reply to a cold mail. If a buyout already happened somewhere you depend on, watch the plugin's changelog and the registry's notices, and pin versions until the new owner has a track record. Report suspicious takeovers to the registry's plugin or add-on team.

#Checklist

• Is the buyer a company I can find in an official register, with a consistent name?
• Does the mail domain lead to the buyer's own business?
• Am I free to sell every asset, contribution and line of data they ask for?
• Do they want registry access, credentials or a full export before an agreement?
• Would I be comfortable telling my users about this sale before it happens?

#Frequently asked questions

Is every offer to buy a plugin a scam?

No. Plugins and extensions are bought and sold for good reasons. The risk is that the buyer gets your users' trust and the update channel, so the buyer must be identified and the transfer must be public.

Can I sell my game's code for AI training?

Only what you fully own, without third-party assets, contributions you may not relicense, secrets or personal data, and only to a buyer you can identify. When in doubt, the answer is no.

What is the safest way to look at a draft agreement from an unknown buyer?

Not to open it. Ask for the terms in the body of the mail. A real buyer can write them there.

#Sources

• Anchor Hosting: plugins bought and backdoored (2026)
• MIT Technology Review: AI labs are buying data from dead startups (2026)
• WordPress.org detailed plugin guidelines
• Business registers: search for a company in the EU, e-Justice portal