I think that you and tredre3 are entirely missing the problem — you seem to be assuming that vscode works the way that any sensible person would assume that it

I think that you and tredre3 are entirely missing the problem — you seem to be assuming that vscode works the way that any sensible person would assume that it works. Of course VS Code runs things remotely. Of course running an untrusted project on a remote machine runs code on the remote machine. This isn’t the problem. The problem is that the remote project can run code on the client front end. You can create a brand new cloud machine, give it no particular permissions, run vscode on your laptop, connect to the remote machine via the remote extension, and load some compromised package npm package, and you expect that the damage is limited to the remote machine. And you would be wrong! The npm package can execute code on your laptop or borrow your ssh credentials, and MS doesn’t even consider this to be a bug! https://github.com/microsoft/vscode-remote-release/issues/6608 https://github.com/microsoft/vscode-remote-release/issues/66...