I felt/feel the same, but I am greatly comforted by the add-on making an attempt to clearly communicate what it uses/needs each of those permissions for: https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim...

Even though there’s no guarantee that the explanation corresponds exactly to what is implemented behind the scenes, this unusual pattern of user respect and consideration makes the add-on/developers feel more trustworthy than other sketchier ones.

This is about the only type of addon that genuinely needs full access to everything - the type that replaces your browsing interface. It needs to be able to interact in all the possible ways with every single element on the page. There's no way around it having scary powers, because using them is its base purpose.

I'm really glad that other people feel that permissions over-reach is a problem.

Specifically in the case of Tridactyl, as an interface to the entire webbrowser is needs access to the entire web browser. It does manage bookmarks, it does modify webpages (by adding link hints).

It's open source, just read it and use the source-code release https://github.com/tridactyl/tridactyl

Is it possible to validate what I am running in browser is an unaltered version of what is there in Github?

Otherwise, I will have to trust the package author to not be malicious.

Another option might be to personally package and sideload the extension which I don't know how.

Yes, that's what I meant! It's very easy to sideload.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web....

Tridactyl exists in the Arch community repos [1] if you would rather use that; you're effectively shifting your trust to an Arch trusted user away from some random person (me) and Mozilla.

[1]: https://www.archlinux.org/packages/community/any/firefox-tri...