Comment by geofft

The Debian package of Firefox is not supposed to pull any code directly from Mozilla - whether security updates, marketing tie-ins, updated SSL libraries, whatever. Like all Debian packages, code is supposed to go through Debian. The only Debian programs that are supposed to fetch code on their own are ones where you explicitly tell it to do so (e.g., you're running `pip install` or something).

So the only way this code would end up on my machine is one of two ways:

1. The Debian Firefox package is pulling code from Mozilla without the maintainer's review (which is definitely possible, given how complex Firefox is and how there's approximately one person packaging updates including timely security updates), which would of itself be seen as a serious problem

2. The Debian maintainer specifically picked up this code as part of the tarball from Mozilla, and shipped it without noticing (also definitely possible!) or decided it was worth including

For what it's worth, I do not have this plugin in about:addons, and Debian unstable hasn't picked up a Firefox update since December 1, so as far as I can tell the system is working properly.