It certainly appears to be monitoring the entry of passwords into Facebook, but given the stated purpose of the extension ("Record activities undertaken in the content area for later playback") it's not clear to me that this is the same as "stealing". We'd need to see code that shows the recorded content being exfiltrated to somewhere else, which should be pretty obvious by watching network traffic and or doing a full review of the code.