Back in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature

Back in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature to download remote code and add it to the extension so to say. As long as that practice is allowed, source review would not help. [1] https://labs.detectify.com/2015/11/19/chrome-extensions-aka-total-absence-of-privacy/ https://labs.detectify.com/2015/11/19/chrome-extensions-aka-...