The bug exposes the Metro development server to remote attacks, allowing arbitrary OS command execution on developer systems ...

A suspicious Visual Studio Code extension with file-encrypting and data-stealing behavior successfully bypassed marketplace ...