Scanning for Malicious VS Code and OpenVSX Extensions

[abhisek]

We will use this thread to showcase and collect feedback on how SafeDep vet can scan VS Code and OpenVSX extensions for malicious code.

Note: These two ecosystems are new in our package scanning infra. Currently at experimental stage.

[abhisek]

@Sahilb315 Can you share some examples on how we can scan VS Code and OpenVSX extensions with vet?

[Sahilb315]

vet can scan the installed extensions based on the IDE's supported by us, such as VS Code (defaults to VS Code Marketplace), Cursor, Windsurf, VS Codium (defaults to OpenVSX registry)

Default scan:

vet scan --vsx

This command scans all the IDE's extensions

To scan specific IDE's:

vet scan --vsx --vsx-dir /path/to/ide_extensions

Example :-

vet scan --vsx --vsx-dir ~/.vscode/extensions/ --vsx-dir ~/.cursor/extensions

This command will scan only VS Code & Cursor extensions