作为桌面上的 Electron 应用程序，在 VSCode 内部执行任意 JavaScript 无异于完全的远程代码执行。这就是 VSCode 实施一些沙盒化方法的原因，我们将重点讨论的是 VSCode 的 Webview。

A threat actor called TigerJack is constantly targeting developers with malicious extensions published on Microsoft's Visual Code (VSCode) marketplace and OpenVSX registry to steal cryptocurrency and ...

A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to "infect" over 100 organizations by trojanizing a copy of the popular 'Dracula Official theme ...