The leak has now been fixed. According to the Open VSX team, the incident has been fully contained and closed since October ...
Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.