Malicious VSCode Marketplace extensions hid trojan in fake PNG file