A VSCode extension attempted to read/write to my contacts and calendar on macOS. Thankfully the sandbox (?) permissions UI notified me, I reported it to Microsoft and I believe they either pulled it or wound it back to an older version without that code in it. It had no need to access that data, so god knows what it was trying to do.