Devs, be careful what you plug in: GitHub security breach was apparently facilitated by a 'poisoned Visual Studio Code extension'