This is a very well done attack. Enjoyed reading about your efforts to gain community credibility. You rapidly transformed this from a small number of victims into an epidemic.

I'm surprised that VSCode extensions don't have a permissions system (EG: "Request network access").