Rapid Containment

Microsoft and extension maintainers remove the identified VS Code theme loaders quickly, while Socket publishes indicators of compromise and affected package names. The incident remains a narrow software-supply-chain cleanup rather than a systemic compromise of the VS Code ecosystem.

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.