I am honestly surprised there wasn't a big VS Code Extension targeted npm attack.