It should be possible to look at the source code of known compromised extensions and put together a list of heuristics that could automate part of the process. Minifiers make it more difficult though.