I recall reading about this being done already. I forget names, but usually popular extensions are then sold to unscrupulous parties which add new code to do malicious stuff like this.