VSCode Extension Host Querying GitHub Repos API
Detects the VSCode executable making direct web requests to the GitHub API. This may indicate a malicious extension exfiltrating or validating stolen OAuth tokens, as demonstrated in the 1-click GitHub Dev/VSCode webview attack.
Sigma
