[basil-rash]

Indeed. One should always disable extension auto updating. Besides that, there’s not really any less security than NPM packages. It’s the open secret of the whole industry that we just open ourselves to RCE every day because the alternative (vetting dependencies) is too annoying.

[mannycalavera42]

<< If you don't want VS Code to even check for updates, you can set the extensions.autoCheckUpdates setting to false. >>

https://code.visualstudio.com/docs/editor/extension-marketpl...