A firefox extension .xpi malware scanner python script and live malware examples.

Scanner Availible here - https://www.github.com/ernos/browser-xpi-malware-scanner

First malware found. Full trojan with remote commands sent from a C2 server and full password-stealing, command injection and sandbox breakout:
First Malware Found - Full Trojan with remote C2 server etc YTMP4 Youtube Downloader MP4

Second malware found. Affiliate click fraud:
The Ad-Blocker That Steals Your Clicks: Inside "Supreme Adblocker for Youtube"

Third Malware found in the wild:
How I Built a Browser Extension Malware Scanner — And Used It to Expose a Malicious "YouTube Downloader"

All of these extensions are still live at https://addons.mozilla.org