There has been a rash of scurrilous people buying popular Chrome extensions and or paying owners to add malicious code. The malicious code can add third party

There has been a rash of scurrilous people buying popular Chrome extensions and or paying owners to add malicious code. The malicious code can add third party script references which then behave differently depending on target user or time of access, and these can be credential thefts/keylogging, (very inefficient) cryptocurrency miners, ad injection or participation in click farms, or just general connivery. I'm very glad Google is starting to do source code review on extensions, it's long overdue given the access they have.