[zombot]

The post title really buries the lede.

> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.

The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance.

Never open 3rd-party stuff with VSCode.

[zeratax]

Okay but this is just not true here. VSCode always first asks you if you trust the author of this code and if not gives you the option to open the directory in restricted mode

[CITIZENDOT]

> VSCode always first asks you if you trust the author of this code

until we do that, VSCode doesn't let us interact with the codebase, so we end up clicking that trust as soon as we open the directory and move on.

When VSCode detects launch commands in ".vscode", It should be rather explicit about running it, like "Trusting this workspace runs the following command on your behalf"