VS Code

lol, release-notes.js - obfuscated; at first I thought it was the release notes data or content, but maybe it's the logic for displaying it?

Outdated sanity-io dependency somehow led to compromise? I still don't get how. It wouldn't suddenly integrate something else. Does it source data from elsewhere during build, and that was compromised too? Does it call into the web for no reason in the first place?

Either way, it's an issue of their integration. Claiming "it's not an issue in our extension" while shipping compromised code is just wrong.

Obfuscating their index.js theme logic because it's closed source may seem fine if they're trustworthy, but with this violation and breach, that trust is gone.