I caught this suspicious process running under VS Code:

  /usr/bin/ps -ax -o pid=,ppid=,pcpu=,pmem=,command=

I expected a rogue extension was responsible. Rather, the spyware ships with VS Code in this commit:

https://github.com/microsoft/vscode/commit/307987fe383950b8f...

Screenshot of the running process: https://pbs.twimg.com/media/FrSfjwtWYAE02hC?format=jpg&name=...