Once thought to be a reliable indicator of trust, the blue ‘check’ icon next to an extension’s name can now be spoofed.

The easiest way to get bogged down is to install the often recommended tools and frameworks (NPM, Yarn, PNPM, NodeJS, React, ...