Hacker News Reader

I unpacked the XPIs and inspected the JavaScript source. Nothing suspicious (remote URLs, obfuscated code, etc) looking in there.

Do firefox extensions auto update? This is the type of extension I rewrite into my own private Tampermonkey script.

Auto-update is configurable per extension, so you could shut it off.