However, it’s important not to confuse the concept of being scammed (social engineering) with being hacked (technical breaches).

Consider uninstalling the malicious Stylish extension. In 2016, with no input from the userbase, through some guy, pretending to be an independent developer, it basically was sold to a shady web analytics company, Similarweb. Since then, it is actively sharing your entire non-anonymized browsing history demo with them, assuming you ever clicked on one of the flashy "Agree" buttons. It initially did this without even asking for consent, and was banned from extension stores afterwards. Currently, it still breaks store policies, yet is not banned for unknown to me reasons. This website only works with the Stylus extension, which is an open-source privacy-friendly fork of the now-malicious Stylish extension.

Here is a simplified example of a malicious .gitlab-ci.yml