I wonder if it was open-vsx specific?
This seems to be confirmed here: https://socket.dev/openvsx/package/whatwedo.twig/versions/1....