You can also, more conveniently, plug an extension's URL into this viewer:

https://robwu.nl/crxviewer/

Now I have to trust that viewer doesn't hide the malicious code, nor that my browser does (presumably from an existing untrustworthy extension)