Google decided to fork Visual Studio Code because the standard extension API was too restrictive for an agent-first plan.
Researchers found malicious VS Code extensions and Go, npm, and Rust packages stealing developer data via hidden payloads and exfiltration.
Two malicious extensions on Microsoft's Visual Studio Code Marketplace infect developers' machines with information-stealing ...