Hacker News Reader

I think VS Code extensions autoupdate by default, unless you disable it.

Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.

I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.

Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.

Emphasis on guessing. If/when there is an actual postmortem, you’ll know when the back door was introduced.

You are either lucky or compromised.

Not updating air gapped systems is a security feature, not a bug.