Nothing, but that extension would be flagged as "unknown" or "third-party" source or something and you'd get a big warning before proceeding to install it.
Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.
A big danger warning before installing extensions is a great way to kill your FOSS extension crowd off. Verifying ownership of a domain doesn't even guarantee that anything about the extension is trustworthy. People get phished all the time and skip through warnings.
Scanning is a curious one. It's not always obvious because developer tools have legitimate reasons to do a lot of these things. LLMs are better at understanding what it's actually doing now though so that might have worked. But who knows, people have snuck in backdoors into many things before.
Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.