[euid]

You can audit the code of a Firefox extension by unzipping the .xpi file in the extensions directory within your browser profile directory.

Not ideal, but it's better than nothing.

[jyr0s]

Are you proposing to do that for every update that comes in, for every extension? Far from ideal.

[euid]

Oh, yes, it's far from ideal.

I'm reminded of the ArchLinux AUR, which deals with a problem kind of like this. AUR managers show a diff of what changed in a package on each update.

Perhaps one could make extension auditing easier by scripting together a Git repository from extracted xpis, and presenting updates as patches to that repository. This is probably only viable for high-security environments - it's not with it in the common case.

Of course, the real fix would come from Firefox itself: it should provide signed extensions and a way to tie them back to Git repositories with source code, which would eliminate the need for the above automation, and allow people to crowdsource extension auditing.

[Hitton]

Since the rise of typescript and other transpilers to javascript, this isn't very feasible.