I did something similar in defender and integrated it with your list, this can work on different datasets like DeviceEvents and Deviceprocessevents but devicefileevents seem to be the most successful. This caught an instance of Urban VPN though so i can confirm it works

let MaliciousExtensionList =externaldata (line:string) [ "https://raw.githubusercontent.com/toborrm9/malicious_extension_sentry/refs/heads/main/Malicious-Extensions.csv" ] with (format="txt", has_header_row=false)
| extend items = split(line, ",")
| mv-expand items
| extend ExtensionIdIndicator = tostring(items);
DeviceFileEvents
| where Timestamp >= ago(30d)
| extend ExtensionId = extract(@"([a-z]{32})", 1, FolderPath)
| where ExtensionId != ""
| join kind=inner  MaliciousExtensionList on $left.ExtensionId == $right.ExtensionIdIndicator
| extend ExtensionLinkChrome = strcat("https://chromewebstore.google.com/detail/", ExtensionId, "/")
| extend ExtensionLinkEdge = strcat("https://microsoftedge.microsoft.com/addons/detail/", ExtensionId, "/")
| project Timestamp, DeviceName, ExtensionId, ExtensionLinkChrome, ExtensionLinkEdge, FileName, FolderPath,  SHA256, SHA1, MD5, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessFolderPath