Somewhere inside GitHub, a developer installed a Visual Studio Code extension. It looked like any other productivity plugin ...
Security researchers say 5,500 GitHub repositories have been affected by the attack.