How can an extension change hands with no oversight?

Honey-like affiliate hijack in question ...

Do you use the Chrome extension "Save image as Type?" If so, you are one of more than one million users who woke up this ...

Hackers use credentials stolen in the GlassWorm campaign to access GitHub accounts and inject malware into Python ...