Vendor
Threat actors can gain persistence or code execution by sideloading malicious IDE extensions via the VSIX format, often triggered by script hosts or from volatile staging directories.