VSCode 버그를 통한 1-클릭 GitHub 토큰 탈취

A critical vulnerability in VSCode's webview isolation allows attackers to steal GitHub OAuth tokens via github.dev with a single click, compromising access to all user repositories including private ones. The flaw stems from passing keyboard events across security boundaries without proper validation, exposing a fundamental weakness in how trusted and untrusted contexts communicate. This poses severe supply chain attack risks affecting millions of developers and enabling unauthorized access to sensitive codebases.