The amount low-effort/low-value extensions on the VSCode extension marketplace are astonishing. Searching for "darcula" shows around 100 typo-squatting themes,

The amount low-effort/low-value extensions on the VSCode extension marketplace are astonishing. Searching for "darcula" shows around 100 typo-squatting themes, who knows how many of which are malicious. I think both the distribution mechanism and the language shortcomings contribute to the problem. Users publish their extension which may or may not reflect the reported repository. Users download a bunch of amorphous JS code (perhaps compressed, perhaps obfuscated, perhaps malicious) to their machine and are at the mercy of it. If JS didn't need this build step and a user was able to download extensions directly from the Git forge, then the story would be a bit better.