Security researchers found a harmful extension in the Open VSX registry that installs a remote access trojan called SleepyDuck. Initially released as harmless, the extension was updated shortly after gaining 14,000 downloads, enabling it to access user systems and exfiltrate data. Users are warned to be cautious when downloading extensions from unverified sources.