https://ateneasystems.es/en/blog/malicious-vs-code-extension-github-breach/
18 minutes was all it took: how a VS Code extension walked off with 3,800 private GitHub repos —...
The theft of GitHub's internal repositories didn't start by breaking a firewall: it started on a developer's laptop that installed a poisoned extension update....
walked off withvs codegithub reposminutestook