And it's only getting worse with the waves of vibe-coders.

I actually wrote about this recently after poking around a popular extension that Antigravity users were installing. It's wild what people are doing with your credentials, and you'd have no idea! https://opista.com/posts/blind-trust-in-vs-code-extensions

The only real answer is something like web assembly and that would be a major breaking change for them.

This is why allot run dev containers but agreed this really should be top priority but instead is probably in the "maybe if we have a major security incident" bucket of concerns as these things often are

There's no malware in it currently, but I understand your concerns - I could be lying, go rogue later, or just get my access stolen.

One option is to vet a version yourself and disable auto-update, but that's not really feasible to spend time on for most people.

Doesn't seem like it. It will be stuck in a security theater situation, just like Chrome extensions. Not an upgrade from the old highly powerful firefox extensions or those of the Atom text editor.

[dead]