The "JSON prettifier" example is exactly what compromised my browser once, long ago. I only found out because I noticed the "this extension is no longer available on the Chrome store" mention on the chrome://extensions page or something of the sort.

It was silently ex-filtering list of all URLs I visited against a unique identifier.