Browser extension stores should be more transparent about open source and licensing.

And probably they should collaborate with CI providers - eg. make contract with GitHub to sign artifacts with "these files were built using following pipeline from commit XYZ in repository JohnSmith/UserBase".