My worse fear has materialized.
This is why I've never used an external Obsidian plugin and only my own plugins.
It was only a matter of time before some malicious code ended up in one.
Brother, we are vindicated! There are indeed many cool bits and blobs out there, but I am already trusting one entity to secure my private notes, no way I am taking a pinky-promise from extension XYZ to behave.
(I actually use LogSeq, but same idea applies).