

Such tricks were was predictable, as VSCode extensions, letting arbitrary JS run on your system, are an obvious security risk.
Recently I used Zed editor instead, it’s smooth, but this also has extensions, only these are fewer and in rust ( maybe a higher barrier, targeting less users, so far… ). What’s the solution here - is there some intrinsically safer sandboxed system ?



It seems so far Zed is cautious, providing api only for specific extensions - i.e. language servers and gui themes.
I run stuff from the command line using a trusted build tool (Mill, in scala), or via a local server (where js is sandboxed).
But indeed, a tricky language server or AI tool (I don’t use yet) might inject code where I don’t inspect before running it. That’s a risk even with java-based IDEs - java has security permissions, not in js (vscode) or rust (zed), but are they applied…? As for audits, a problem with vscode is the marketplace got too big, so many extensions, many lookalikes, nobody can check them all…