A colour theme is supposed to be a file of colours; these shipped 59 KB of code on a single line, hidden in invisible characters
2026-10-06Security
Socket.dev found VS Code themes on the Marketplace and Open VSX carrying obfuscated loaders. One used a publisher identity imitating Microsoft. The payload was compressed onto one line and encoded with invisible Unicode, then written to a temporary script and run with no window shown. Microsoft removed them, which does not uninstall anything.