A suspicious file URL has been exposed in VSCode Insider

[James4Ever0]

Does this issue occur when all extensions are disabled?: Yes

System info:

Version: 1.97.0-insider (user setup)
Commit: 3d0aeb47a2ecfde9ff5141470b30c36d41c321d9
Date: 2025-01-20T05:04:25.114Z
Electron: 32.2.7
ElectronBuildId: 10660205
Chromium: 128.0.6613.186
Node.js: 20.18.1
V8: 12.8.374.38-electron.0
OS: Windows_NT x64 10.0.25300

Steps to Reproduce:

1. Search for the keyword "file:///D:" in the VSCode installation folder
2. Observe the suspicious string file:///D:/a/_work/1/s/extensions/microsoft-authentication/node_modules/@azure/msal-node-extensions/dist/Dpapi.mjs in resources\app\extensions\microsoft-authentication\dist\extension.js

Notes:

Have not found this string in VSCode code base. Maybe it is in the source code of @azure/msal-node-extensions, or the dependencies of microsoft-authentication.

[TylerLeonhardt]

Yes, it comes from here: https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/extensions/msal-node-extensions/src/Dpapi.ts

but it's for a feature of @azure/msal-node-extensions that we don't use at all, cache persistence. We brought this library in for a different feature, brokering. It's all doc'd here:
https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/extensions/msal-node-extensions/README.md#about