If I had to guess it is the NX console extension that was compromised yesterday. But I’m not 100% sure.

https://github.com/nrwl/nx-console/security/advisories/GHSA-...

NX again??

This isn't the first time their plugin has led to RCE...

It's absolutely reprehensible that they don't immediately name the extension.

Unless it was "Waifu-SFX-AutoComplete"

That kind of thing might be a case to not publicly disclose..