Flaws in four popular VS Code extensions left 128 million installs open to attack