One Poisoned Extension, Thousands of Repositories: The Hidden Risk Inside Developer Desktops

A reported compromise tied to a Visual Studio Code extension shows how a single trusted tool can become a gateway into source-code assets and internal development workflows.