Original link: Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft / HackerNews.
That is actually a pretty scary supply chain attack. Buy an existing non-malicious product and turn it malicious.