Personally, I feel the VS Code team did the right thing in pulling the extension when they realized it was potentially malicious although I do feel they would have been better served in saying that it was potentially malicious and to simply suspend it until they had confirmation of malicious intent.
I'm more interested in discussions on how this would be handled in other projects and the kind of SOPs companies may already have in place for these kind of scenarios.
