upvote
I think VS Code extensions autoupdate by default, unless you disable it.
reply
Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.

I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.

Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.

reply
Emphasis on guessing. If/when there is an actual postmortem, you’ll know when the back door was introduced.
reply
You are either lucky or compromised.
reply
Not updating air gapped systems is a security feature, not a bug.
reply