ABUSING VS CODE'S BOOTSTRAPPING FUNCTIONALITY TO QUIETLY LOAD MALICIOUS EXTENSIONS

Summary from the TLDR InfoSec newsletter

VS Code extensions allow attackers to stealthily install malware, despite Microsoft's protective prompts. This post illustrates how the initial installation process can evade these defenses and affect existing installations, along with detection methods for this attack.