Comment by yunnpp

Nothing, but that extension would be flagged as "unknown" or "third-party" source or something and you'd get a big warning before proceeding to install it.

Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.