Flaws in popular VSCode extensions expose developers to attacks