Hacker News Reader

Exactly and why wouldn't the thieves publish to the official VS Code or Open VSX market places?

Because what they had was some kind of admin access to Cursor's mirror of OpenVSX, and not anything else.