> please only use official builds
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.
According to Felix from Anthropic: no [1]. This didn't seem to impact the official VS Code repository, etc.