And yet, this entire class of abuse is only possible because Microsoft refuse to implement any kind of permission management or sandboxing for extensions.

https://github.com/microsoft/vscode/issues/52116

2 seconds? That wasn't the team then, it must have failed some automated filter.

Unfortunately the marketplace ecosystem is why I went back to VSCode from Cursor. I'm a bit upset by this because I don't quite appreciate that Microsoft has a closed ecosystem for the marketplace and does not open it to Cursor but the reality is, that Open VSX does not have all extensions and little vetting.

People better remember that tweet the next time somebody finds another malicious extension on their marketplace.

and yet, there are many malware extensions per day that get through:

https://github.com/microsoft/vsmarketplace/blob/main/Removed...

Well this was an extremely unsophisticated attack. The malware wasn't hidden and they didn't even bother to actually copy the real extension.

If I were doing this I would copy the real extension, give it a name that made it sound official but in the README say it is a tweaked version with some improvements or whatever. Also actually add some improvements, but hide the malware in those changes.

Good luck finding that. (brb going to try this)