Two VSCode extensions are harvesting sensitive data and sending it to China.