How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff like this get out of hand quickly!
I can only think that strong application whitelisting would control this, or have a security policy for these application extras. (Is there a proper term for that instead of using application extras?)
I'm having trouble finding what Microsoft's stance is for PowerShell modules and the Code Marketplace? How are they making sure that those extras aren't malicious? How is any business making sure those extras aren't malicious?