Repo Does not Exist
Flags items that have claimed to be open-source but the repository does not exist.
medium
Findings
Unverified Publisher
Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.
medium
Publisher Low Install Count
Flags publishers lacking installs on the marketplace, suggesting concerns about the publisher's reliability.
low
All findings are available for Enterprise users
Code analysis
AI-powered analysis of the extension's source code for security insights and risk assessment.
high
Enterprise Only
Enterprise Only
Enterprise Only
medium
Enterprise Only
Enterprise Only
Enterprise Only
low
Enterprise Only
Enterprise Only
Enterprise Only
CODE INSIGHTS ARE AVAILABLE FOR ENTERPRISE USERS
API Calls
API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.
low
process.nextTick
nodejs
/extension/node_modules/yazl/index.js
low
fs.stat
nodejs
/extension/node_modules/yazl/index.js
low
fs.createReadStream
nodejs
/extension/node_modules/yazl/index.js
All API calls are available for Enterprise users
Secrets
Any encoded/decoded secrets we managed to find in the source code, git repository, or related files
Gitlab
/extension/node_modules/@vscode/vsce/dist/vsce.d.ts
Unverified
Gitlab
/extension/node_modules/@vscode/vsce/out/main.js
Unverified
Github
/extension/node_modules/cheerio/Readme.md
Unverified
All secrets are available for Enterprise users
Vulnerabilities
Known vulnerabilities and security issues detected in the extension's dependencies and code.
high
Enterprise Only
Enterprise Only
Enterprise Only
medium
Enterprise Only
Enterprise Only
Enterprise Only
low
Enterprise Only
Enterprise Only
Enterprise Only
VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS
External communication
Any identifiers we detected that may indicate external communication from the item's code
high
Enterprise Only
Enterprise Only
Enterprise Only
medium
Enterprise Only
Enterprise Only
Enterprise Only
low
Enterprise Only
Enterprise Only
Enterprise Only
EXTERNAL COMMUNICATIONS ARE AVAILABLE FOR ENTERPRISE USERS
Dependencies
Dependencies and third-party libraries used by the extension, including version information and license details.
@vscode/vsce
Version:
2.22.0
punycode
Version:
2.3.1
url
Version:
0.11.3
All dependencies are available for Enterprise users
Licenses & Compliance
high
Enterprise Only
Enterprise Only
Enterprise Only
medium
Enterprise Only
Enterprise Only
Enterprise Only
low
Enterprise Only
Enterprise Only
Enterprise Only
LICENSES & COMPLIANCE ARE AVAILABLE FOR ENTERPRISE USERS