Hacker News Reader

We simply can't, I guess. Not after the original repo is long gone due to DMCA. Therefore, better to mention to do your own due diligence.

You run it in a VM that you only use for casual web browsing, so the scope of possible damage is limited.

We read the source code.

Then it auto-updates.

Then we blindly trust that someone else is still reading the new version’s code and will raise the alarm if something bad happens.

I highly recommend turning off auto updates on browser extensions.

I suggest looking into the Obfusicated C contest before relying on your own reading of code to verify lack of malicious intent.

There's no source provided in the repo? It seems to just be a discussion of how to download the xpi from somewhere else.