Tag OIDC token theft

GitHub confirmed 3,800 internal repos were breached by TeamPCP via a poisoned VS Code extension in May 2026. Here's exactly how it happened.