That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.

You disable extension auto updates and then manually install every so often (and only update/install when the version has been out for 3+ days).

I recommend moving to VSCodium and using this extension:

https://github.com/jeanp413/open-remote-ssh

and run vscode-server inside a VM or container

[dead]