VSCode Private Extension Repository for teams

I'm writing highly specific private VSCode extensions for our dev team. I will be making constant changes to these extensions. From what I've read, the only way is to compile the extension as a .vsix file and send this file to each of the team.

This workflow is tedious and feels unnecessary.

I am looking for a more automatic and transparent solution, which more or less updates the private extension automatically.

Has this scenario been solved?

Can VS Code extensions be malicious?

Generally considered secure, VS Code extensions could expose millions of developers to malicious attacks, potentially leading to the compromise of information stored on developer machines, such as credentials, or even opening the route to further attacks.

Not as of VSCode 1.14 but we are tracking the feature request here: https://github.com/Microsoft/vscode/issues/21839