What a Compromised VS Code Extension Could Do Before You Write a Line of Code
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A detailed investigation of 40 VS Code launches measured what popular extensions do before a developer touches anything. Prettier added no identifiable background process, while GitLens activated at startup and launched gk helper processes that made outbound network connections. The author stresses that neither extension showed signs of compromise.