One Click in a Malicious VS Code Project Can Give Attackers Persistent Access to Your PC