GitHub just confirmed it: one malicious VSCode extension exfiltrated tokens from 3,800 repositories. Not 38. Not 380. Three thousand eight hundred.
If you're a vibe coder who installs extensions to make your editor look cool or speed up boilerplate, this is the moment to read the rest of this post.
Because the worst part isn't that it happened. It's how boring the attack was.
What actually went down
The extension shipped as a normal productivity tool, passed marketplace review, and racked up installs. Then it shipped a quiet update. That update did three things:
