Indeed, and I'm glad I saw the discussion and switched to Imagus and then Hover Zoom+, but if I had missed discussion of Hover Zoom's spyware activity I would have kept using it. We need better mechanisms of keeping people constantly informed about bad extensions, and ideally, ways of shutting them down.

Known to whom?

This is very relevant as part of the broader conversation about defaults and the trade-offs to be made between flexibility for power users and relatively more safety for most users.