OpenVSX has no extension signing, no verification, nothing...
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed
OpenVSX has no extension signing, no verification, nothing...
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed
Wait... and people use this?
People tell me you can just have directives in a markdown to tell AI not to use certain directories or privileges. They really have no idea.
People here copy and paste random "curl $x | bash" commands all the time.
I doubt these vibe coders understand what you're saying.