That was the end of February, so not sure but that may be it.
Imagine uBlock Origin's Chrome extension author creds were hacked. "He" publishes a new version of the Chrome extension that monitors coinbase.com and fakes the transfer/confirmation screen, or submits transfers in the background. The extension has "write" access on all sites, so the rogue extension can also monitor your Gmail and silently inject a filter that routes trade confirmations to trash.
Or the "requests" library in Python gets an update to replicate 2FA codes via Twilio to a 3rd party.
Sure, you can do pinning and cryptographic signatures to verify that v 1.0.0 of X is really what you expected.
But who audited 1.0.0 of X in the first place...?
We are one step away from very bad shit hitting the fan in a very painful way... so let's pretend everything's fine and try not to think about these things.