“While the extension was supposed to be a simple theme configuration (no code should be included), it had a simple PII stealer code”
“Theme Darcula dark” had more than 45k installs and shipped code that sent installer metadata to a remote machine. A colour theme needs zero code. “prettiest java” squatted on Prettier-Java and posted local secrets to a Discord webhook. Microsoft’s marketplace scanning missed all of it until Check Point called. Developers hand their editor the keys to every repo and cloud account they own, and the store does not check whether a theme runs code.