Microsoft has had a VS Code extension for a long time, and it finally came back to bite them.

Sometime in early 2025, an attacker slipped malicious code into a Visual Studio Code extension, and a GitHub employee installed it. For several days, that extension ran quietly on the developer’s ...