VISUAL STUDIO CODE EXTENSIONS ARE MUCH LESS SECURE THAN BROWSER EXTENSIONS OR EVEN NPM PACKAGES

Summary from the TLDR newsletter

Extensions in Visual Studio Code can do pretty much whatever they want, they automatically update, publisher accounts are too easy to verify, the code shipped in an update can differ from what's on GitHub, and there's no way to verify the data being used in the extension store indicating popularity or trust-worthiness.