compromised extension then backdoors your code anyway