Comment by nikcub

So it turns out they accidentally included their certificate private key inside the Chrome extension package:

https://twitter.com/nikcub/status/205489752684765185

Edit: just created a fake package and signed it:

https://github.com/nikcub/yahoo-spoof