A published VS Code extension didn't hide the fact that it encrypts and exfiltrates data and also failed to remove obvious signs it was AI-generated.

The leak has now been fixed. According to the Open VSX team, the incident has been fully contained and closed since October ...