[diarrhea]

I've had a color scheme plugin yanked from my IDE a while back, as it went malicious (Material Theme). It's just a bunch of hex codes, how is that even possible? Baffling and disappointing indeed.

[throw-12-16]

It gets even worse when you realize most extensions ship bundled node_modules and are a very juicy target for supply chain attacks.