GitHub confirmed unauthorized access through a malicious VS Code extension — an attack surface I presented at Black Hat MEA last December. Here's how I see it.