VS Code

What are the malicious behaviours? The article is very vague.

lol, release-notes.js - obfuscated; at first I thought it was the release notes data or content, but maybe it's the logic for displaying it?

Outdated sanity-io dependency somehow led to compromise? I still don't get how. It wouldn't suddenly integrate something else. Does it source data from elsewhere during build, and that was compromised too? Does it call into the web for no reason in the first place?

Either way, it's an issue of their integration. Claiming "it's not an issue in our extension" while shipping compromised code is just wrong.

Obfuscating their index.js theme logic because it's closed source may seem fine if they're trustworthy, but with this violation and breach, that trust is gone.

There must be dozens of malicious extensions. I'm honestly surprised we haven't seen it more. Chrome extensions get sold to shady people all the time; I would have thought VSCode extensions are even higher value targets.