A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to "infect" over 100 organizations by trojanizing a copy of the popular 'Dracula Official theme to include risky code. Further research into the VSCode Marketplace found thousands of extensions with millions of installs.
I wouldn’t be so quick to write it off.
It’s a proof of concept showing the weaknesses in Microsoft’s vetting process for extensions published on the store. They then used the process to get pseudo-malicious code inside hundreds of organisations (not hundred of installs) some of which are high profile.
Microsoft doesn’t have a vetting process for publishing extensions in the store. Maybe the failure is that people assume they do?
Surely you mean “that Microsoft does not make it clear that they don’t”?
Maybe, but I think the only app store that does vet apps is the Apple one, so that should be the default expectation.
And I think even they wouldn’t manually look for something like this. They’re mainly concerned about people breaking the commercial rules.