Malicious pull request infects VS Code extension

ReversingLabs discovered a supply-chain compromise of the ETHcode VS Code extension where a throwaway GitHub account submitted a PR that added a carefully named malicious dependency ('keythereum-utils'). The obfuscated dependency is invoked via require(), spawns a hidden PowerShell, and downloads a second-stage batch script likely intended to steal cryptocurrency or otherwise compromise developer systems; the extension was removed from the VS Code Marketplace and a clean version was published, while RL published IOCs and mitigation guidance.