Comment by lajawfe

Is it possible to validate what I am running in browser is an unaltered version of what is there in Github?

Otherwise, I will have to trust the package author to not be malicious.

Another option might be to personally package and sideload the extension which I don't know how.