Considering vscode is itself malware. Probably nothing other than, yes, use a separate VM.

I am an avid vscode advocate, but it is incredibly invasive and security ignorant.