Be careful with those VS Code (or browser) extensions out there.
The research team at Mend.io uncovered a fake VS Code extension "truffelvscode" (which supposedly imitates the legitimate "Truffle for VS Code" extension).
1️⃣ The extension starts with a heavily obfuscated index.js file that runs an "exec" command to download an obfuscated batch file.
2️⃣ Then the batch file downloads a DLL using PowerShell WebRequest silently.
3️⃣ The DLL downloads and runs a ScreenConnect installer with a system.config file containing the attacker remote host, port and encryption key.
4️⃣ ScreenConnect then immediately connects to the attacker machine (a .ru host).