MEDIUM wildcard-activation Extension activates on every VSCode launch
package.json
`package.json` declares `activationEvents: ['*']`, so the extension runs on every VSCode launch. Combined with any CRITICAL finding this widens the attack window from on-demand to always-on.
activationEvents: ['*']Affected versions
marketplace 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.15.1, 1.15.2, 1.15.3, 1.15.4, 1.16.0, 1.16.1, 1.16.2, 1.16.3
open-vsx 1.14.0, 1.15.1, 1.15.4, 1.16.0, 1.16.1, 1.16.2, 1.16.3