One detection angle worth adding: ELECTRON_RUN_AS_NODE is a documented Electron feature, so any editor process launched with that variable set is a cheap, high-signal hunt. It also survives the masquerade. The publisher name and extension ID can change per campaign, the env var cannot, because the technique breaks without it. The point about preserving the VSIX together with the workspace settings is underrated too: the hash identifies the archive, but the googleUpdateSupport.* configuration is what tells you where a given installation was actually sending data.