Somewhere inside GitHub, a developer installed a Visual Studio Code extension. It looked like any other productivity plugin ...
A single browser tab, a single click on “Install,” and a cybercriminal group called TeamPCP was inside GitHub’s own house.