Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces