Attackers can abuse VS Code configuration files for RCE when a GitHub Codespaces user opens a repository or pull request.
Eclipse Foundation to require pre-publish security checks for Open VSX extensions to reduce VS Code supply-chain risk.