VSCode extensions pulled over security risks, but millions of users have already installed

Malicious code seems to have introduced into two VSCode extensions somewhere along the way.