GitHub confirms breach of 3,800 repos via malicious VSCode extension