This familiar story is becoming more common: something as innocuous as an extension contains malicious code ready to steal ...