Plus the commits are "file uploads". Plus the minified multi-MB source files.
My spidey senses are tingling.
The extension contains no active network communications, no runtime use of webRequest or declarativeNetRequest, no dynamic code loading, and no modifications to HTTP response headers or CSP directives. References to the domain sdmextension.com[now removed anyway] exist solely as unused string constants, entirely inert and functionally irrelevant. The extension’s declared purpose is consistent with its implementation. Accordingly, any assertion that this extension constitutes or facilitates malicious activity is currently unsupported by any evidence.
I could tell that this was due to lack of experience because there were other obvious mistakes you’d made which were harmless.
What you need to appreciate is that you’re asking people to install untrusted software on their computers. So while you might feel attacked, the burden of proof is actually with you to demonstrate that you are trustworthy.
And that means eating some humble pie here. Learning from the feedback you’re receiving and grow from it. Rather than demanding that the community fix your shortcomings. We don’t owe you our time any more than we owe you our devices to beta test your software projects.