There must be dozens of malicious extensions. I'm honestly surprised we haven't seen it more. Chrome extensions get sold to shady people all the time; I would have thought VSCode extensions are even higher value targets.