Comment by the_real_cher

Microsoft’s GitHub was compromised when a Microsoft developer using Microsoft VSCode installed a rogue extension from Microsoft’s VSCode extension library, which is moderated and hosted by Microsoft.

via: news.ycombinator.com/item?id=48204312