I was trying to do something exactly like this a few months ago, but I found that browsers' extension APIs have no way to access files after download. You'd have to intercept a download and manage it entirely in the extension, which will likely break so many JS-driven downloads as to be very bothersome.

Alternatively you would have to install a local helper process outside the browser, and at that point, you're basically an antivirus. In fact, I think AVs are the ones better placed to add this as a feature, as well as already having the significant resources needed to maintain a secure archive of hashes for files (although I had thought up a signature-based scheme that software vendors/distributors could adopt for a small fee).