Thanks, yeah, I def won't install it. Looks like there are some calls to `fs` and `path`, so it's definitely reading the file system, which could be legitimate

Thanks, yeah, I def won't install it. Looks like there are some calls to `fs` and `path`, so it's definitely reading the file system, which could be legitimate, but yeah hard to say. Kinda wild that simply installing an extension can give the author full access and there isn't really a way to verify extension code. I mean even if they had linked a repo that actually contained code, how can I know that the code from the repo is actually the same that gets downloaded when the extension is installed?