Maybe the Cursor IDE compromise? It might be what got Binance. And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.