Attackers took over the publisher token for Nx Console, which has about 2.2 million installs. They pushed a malicious JavaScript file to the VS Code Marketplace. It was up for 18 minutes before it got pulled. Because of auto-updates, that was enough time for it to hit developer machines and exfiltrate .env files and other credentials. Most EDR tools didn't catch it because it was plain JavaScript, not a compiled binary.
Three things made this work:
Auto-updates are on by default. Teams treat them as a convenience and don't review what's being pushed.
People trust the "verified" badge and high install counts. Those don't mean the code is safe.
Developers keep long-lived secrets on their machines. Once the extension ran, it had files to steal.
