Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.