TLDR Tech / InfoSec
VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks
Microsoft now delays automatic VS Code extension updates by two hours, except for trusted publishers like Microsoft, GitHub, and OpenAI, which still update immediately. Users can still trigger manual updates and see why updates are pending. Similar cooldown controls in Bundler, Bun, npm, pnpm, and Yarn limit how quickly newly published, potentially malicious packages reach developer environments.
Read the full story