The popular (> 1 million installs) Chrome extension "Web Developer" was compromised this morning. The hacked version of the extension has already been removed from the Chrome Web Store.
If you have the extension installed you should disable it and reset passwords for any sites you visited this morning.
Is there any way to have Chrome default to an alternate profile when accessing certain sites, or disable all extensions on certain sites? Ideally I'd like to use one profile with no extensions for financial sites, and a separate profile for e-commerce sites, but it requires that I remember to switch to that profile prior to logging-in. Maybe I could block the sites in the profile I use for development to force me to isolate those activities in a "clean" profile.