Would ST be resistant

[PetrKrysl]

Security flaws in VS Code - Tooling / VS Code - Julia Programming Language (julialang.org)
If so, that would be a good boost to ST’s fortunes…

[deathaxe]

Well,

new packages are added to default channel after manual review by community members.

So adding malicious Darcula color schemes is rather unlikely.

If a package’s repository becomes unavailable (returning 404) it is marked missing and will be available only after manual review and re-enabling it to detect possible ownership changes.

Once a package is accepted, there’s however nothing to prevent owners from malicious modifications. As most packages are rather simple and changes are rare these days, chances are high such change is detected by community members, early and package to be removed from default channel.