Hacker News Reader

This attack is exactly why IDE's have a concept of trusted and untrusted locations.

That is a very recent addition. The exact behavior they are describing was in VS Code for almost a decade.

Trusted locations were added to VSCode in 2021.

And VS Code was released in 2015.

And this is 2026

I think many people gets tired so much they will simply trust all the locations.