Interesting if you can get a bug bounty for reporting this. I think if an enterprising bounty hunter heard about that, a bunch of anonymously authored extensions might start mysteriously appearing. It might pay better than building web apps for people on upwork.
I'm not sure what level of KYC the Chrome web store does, but said enterprising bounty hunter might find that it's not that hard to detect a pattern of "Guy reports a lot of suspiciously similar unpopular extensions. Let's get a warrant to find out who he is from his bank and see if Google knows anything about it."
