A malicious extension was published on Microsoft ’s official VS Code marketplace, and was able to remain there for some time ...

Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.