Socket Threat Research

Superior ships its wallet drainer as a routine auto-update to extensions users already trusted

An extension allowlist pins an ID, and the ID survives a sale. The operators behind Superior bought or seeded trust that users had already granted, then spent it in an automatic update that stripped page CSP on the way through.