VSCODE EXTENSIONS WITH 9M INSTALLS PULLED OVER SECURITY RISKS

Summary from the TLDR InfoSec newsletter

Two security researchers reported the ‘Material Theme - Free' and ‘Material Theme Icons - Free' to Microsoft because they seemed malicious. BleepingComputer found a heavily obfuscated release-notes.js file that upon partial deobfuscation makes reference to usernames and passwords in several places. The author of the themes denies any malicious intent and states that a dependency may have been compromised but that Microsoft should have alerted them instead of removing the package.