Actually malicious extension only had 250 downloads, 45k installs extension was sending telemetry only. It’s a very misleading title collapsing two separate incidents into one for the sake of dramatization.
This article also highlighted that automated tools used by VS team are pretty good at catching most of similar issues.
This article also highlighted that automated tools used by VS team are pretty good at catching most of similar issues.