Regarding your second paragraph, that was my understanding. But then Github has its own (well Microsoft's) native app that uses OAuth. So I can't see how they e

Regarding your second paragraph, that was my understanding. But then Github has its own (well Microsoft's) native app that uses OAuth. So I can't see how they ensure an attacker doesn't extract credentials and crypto algorithms from VS Code distribution and get the ability to show any user a genuine "authorize VS Code?" prompt and steal their tokens. But I also doubt they'd just go with a security hole, so either they deal with it somehow or maybe it's not as much of an attack vector as I think...