A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs. In fact, judging by the exploit code, I would guess th

A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs. In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well. In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342 https://www.facebook.com/socialfixer/posts/10155117415829342 I feel like Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension.