VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

Microsoft will add a two-hour delay for automatic updates of Visual Studio Code extensions (VS Code 1.123) to reduce exposure to potentially compromised or malicious extension releases; extensions from trusted publishers (Microsoft, GitHub, OpenAI) remain exempt. The article notes similar time-based install cooldown features were added to Bundler, Bun, npm, pnpm, and Yarn as part of broader software supply chain defenses.