Is there a way to bypass detection of malicious extensions?

[s-h-a-d-o-w]

A few months ago, the TypeScript native preview extension was marked as malicious.
Given that this situation has not been resolved (and there seems to be very little interest) and I would like for my IDE to make use of TS7 - can I tell VSCodium to ignore this somehow, so that I can install the official VSIX manually? Ideally, the override would obviously only be for this one extension.

[daiyam]

While I agree to mark it somewhat malicious, you still can install it if you turn off the unsafe filter with the setting extensions.excludeUnsafes. You might want to re-enable it afterward, it might keep the extension (not tested, not sure about the behaviour)

[s-h-a-d-o-w]

What do you mean by "somewhat" malicious and that you agree? Because I've not seen reasoning for it other than what's mentioned in the thread, which seems unrelated to the official extension.

As for the workaround - thanks but you're right, it has to stay enabled. Otherwise, the extension gets uninstalled on restart.

[daiyam]

What do you mean by "somewhat" malicious and that you agree?

I didn't release it was a squatting case... Thought that MS was doing a new shenanigan think that the OpenVSX team didn't like.

Hum, there should be a whitelist with an added manual confirmation. Because it isn't good to have extensions.excludeUnsafes disabled.

[s-h-a-d-o-w]

I mean... we shouldn't need that. Unnecessary work for you, unnecessary friction for users. Maybe I'm wrong but...
Even though you might not like things that MS is doing (which I obviously agree with, otherwise I wouldn't use vscodium...), they're not criminal. At least not in the sense we're discussing here.

In most cases, maliciousness is clear and doesn't need overriding.
When a squatter is identified, it seems to me that the solution isn't to block that extension forever but temporarily. Unpublish the malicious content, republish the official extension (if the license permits it) and then unblock it.
If the license doesn't permit it, I suppose blocking it forever is the way to go. But as far as I understand the Apache license, openvsx could just republish this extension.

[s-h-a-d-o-w]

This workaround doesn't seem to work with devcontainers by the way.
After some amount of time, I'll get a popup and it'll be uninstalled from the devcontainer.
The global one remains. But I have to keep reinstalling it into the devcontainer.