Mozilla has issued a warning about a Firefox add-on that secretly sent users' stolen passwords to a remote location.