You'll notice
Useful2 Signal1
Marketplace names are escaped in errors so a hostile name can't inject text.
What's wrong with this entry?
Anonymous. No account, no email.
What
When a marketplace fails to load or is not found, its name is escaped before being placed into the message, so a hostile name cannot inject text into what you see.
Details
- Covers both the
Warning: Failed to load marketplace 'warning and theMarketplace "not-found error from/plugin. - Plugin install also passes a callback for the marketplace refresh outcome, so the result of a refresh can be reported back to the caller.
Evidence
Warning: Failed to load marketplace ', Marketplace "
Strings lifted out of the shipped bundle, so the claim above can be checked against them.