I have just analyzed the current code of Steam Inventory Helper. Step by step what it does:

On every single page you visit, SIH executes code at document_start (meaning as soon as the page is opened). It even executes on your about:blank page and in all sub-frames on the currently visited site! The code executed is js/common/frame.js

manifest.json : https://pastebin.com/QUWJ2TG3
js/common/frame.js (slightly unobsfucated: https://pastebin.com/4BLeJr5m )

The code in this file does: Monitor when you are entering the site, where you are coming from on this site, when you are leaving the site, when you are clicking something, when you are moving your mouse (which they even failed to do properly), when you are having focus in an input, and you are pressing a key! It is not monitoring what you type. But when you click something, and it is a link, it will send the link URL to a background script.

This background script is located in /js/common/connectivity.js (https://pastebin.com/RsUDkDNQ).

What this script does is very nasty. First of all, it monitors EVERY SINGLE HTTP request you make. https://gyazo.com/174961cee2cf3cb9fdb4830efb669e63 It will then send to their own server a summary of this HTTP request if some condition is met (promoteButter?).

From this point, everything is a bit messy in their code and I will have to check a bit deeper.

Bottom line is: they are monitoring what sites you visit and may be sending a lot of your online activity to their own server. I couldn't figure out when they do it, yet, but it seems to be for promotional stuff. More importantly, in the future, even if what they do now is legit, you will not be informed about any changes to their permissions, because it basically already has every permission it can get in that regard. Therefore I strongly suggest uninstalling and reporting this extension.

TLDR: Uninstall ASAP.