Security researchers found malicious code hiding in two VSCode extensions Microsoft quickly ... there was “heavily obfuscated JavaScript, which is always a red flag in open-source software.” ...

While VSCode themes should not be using obfuscated JavaScript, the Material Theme – Free' and 'Material Theme Icons – Free' extensions were later proven not to be malicious. Microsoft ...

The two VSCode extensions, which count over 9 million installs, were pulled from the VSCode Marketplace in late February over security risks, and their publisher, Mattia Astorino (aka 'equinusocio ...