Chrome extensions with 1.4M installs covertly track visits and inject code

Why even run an extension store if they aren’t going to bother moderating it?