Researchers at Phorion and OpenSourceMalware found that the attackers inserted a malicious JavaScript loader at the beginning of the extension’s extension.js file, leaving the legitimate extension code otherwise unchanged.

…

However, according to Phorion, coding errors in the malware’s SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems.

The mistakes prevented the malware from enabling SSH on machines where it was not already running, leaving the reverse tunnel unable to provide access to the compromised device.