I've just installed Ghostery 5.4.10 on Opera 37.0.2178.32 (current stable channel).
I turn the browser off and on again and the verification mechanism in my browser doesn't indicate the extension's code is different than the extension's author meant to be on the system.
What you can do is to go to the extension's code folder (which is [browser_profile]/Extensions/bbkekonodcdmedgffkkbgmnnekbainbg) and monitor the changes to the filesystem there (browser's profile folder is shown on "About Opera" page). It will look differently depending on what OS you're using.
Quick googling for Windows showed me this article: http://www.howtogeek.com/205144/how-to-monitor-file-and-folder-changes-in-windows/
Ideally I'd monitor this folder before the extension is even installed. Then the 1st actor who makes changes to this folder should be a browser (installing it). Then the '_metadata' folder should appear with slight delay (this is browser too).
Any later modifications to the extension's source code is a suspicious action.
It might not be a virus, it might be some 3rd party program you've installed doing something. In that case look for an option to leave the browser's profile folder untouched by this software.