VS Code flaw lets attackers reuse deleted extension names, enabling ransomware payload delivery and supply chain risks.