How can an extension change hands with no oversight?

Malicious JavaScript code delivered by the AppsFlyer Web SDK hijacked cryptocurrency, potentially in a supply-chain attack.

Extended header section of parsable attributes, introduced by '#'. Header row of variable name and units for each column. Data rows. Depending on the presence of special keys in the extended header ...