Comment by kevinrineer

There's also the risk that VS Code is a "trusted" application in many enterprises because developers force it to be. VS Code's node runtime (and plugin system) executing somewhat arbitrary Javascript means that any dev servers become vulnerable to exploits you otherwise might not have prepared to defend against [1].

Otherwise, you could see Javascript running on a server and instantly know something was odd, depending on the server.

[1] - https://www.darktrace.com/blog/darktrace-identifies-campaign...