Visual Studio Code 1.128 is out now. It's the latest weekly release and this time brings a handful of new features.
JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.