“Publisher verification is a good practice to ensure the publisher is who they say they are,” said the researchers. “Yet, VSCode publisher verification process is not rigorous enough.