VSCode extensions with 9 million installs pulled over security risks - eviltoast