Security researchers found malicious code hiding in two VSCode extensions Microsoft quickly pulled them and notifies users The developer criticized Microsoft's move, saying they were never consulted ...

"VSCode extensions are an abused and exposed attack vertical, with zero visibility, high impact, and high risk. This issue poses a direct threat to organizations and deserves the security ...

ExtensionTotal says it reported the malicious extensions to Microsoft, but they are still available at the time of writing. The Discord-themed extension on VSCode Marketplace Source: BleepingComputer ...