Revoking Your Token Won't Save You: The VS Code Attack That Installs a Permanent GitHub Backdoor

The Attack That Survives Your Response When a developer discovers a compromised VS Code extension, the playbook is straightforward: uninstall the extension, revoke the OAuth token, rotate your…