Nx Console supply-chain breach exposes users

This is a reminder that editor extensions are part of the trusted computing base now, and compromise there can become instant workstation compromise.

• –The blast radius is unusually ugly because the malware ran on extension activation and went after `gh`, npm, cloud, vault, SSH, and 1Password material
• –The incident wasn’t a generic package typo-squat; it chained an upstream dependency compromise into maintainer token theft and then marketplace publishing
• –The narrow version window matters, but auto-update turned a short-lived release into a real-world exposure event
• –For teams, the lesson is blunt: lock down publisher workflows, harden local dev credentials, and assume editor extensions deserve the same scrutiny as production dependencies