Is Python safe?

Findings

Auto-Installs Additional Extensions

Flags items that automatically install additional extensions as part of their installation. While this is a common way to distribute curated toolsets, it results in other extensions being installed silently - bypassing individual policy evaluation and running code the user never explicitly chose to install.

medium

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

CODE INSIGHTS ARE AVAILABLE FOR ENTERPRISE USERS

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

low

fs.stat

nodejs

/extension/dist/extension.browser.js

low

process.platform

nodejs

/extension/out/client/extension.js

low

process.chdir

nodejs

/extension/dist/extension.browser.js

All API calls are available for Enterprise users

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

SECRETS ARE AVAILABLE FOR ENTERPRISE USERS

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://aka.ms/AAdzyh4

extension/dist/extension.browser.js

https://github.com/python/cpython/pull/116129

extension/python_files/lib/jedilsp/typing_extensions.py

https://aka.ms/AA5rjx5?$

extension/out/client/extension.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

@iarna/toml

Version:

Unknown

@types/bent

Version:

Unknown

ts-mockito

Version:

Unknown

All dependencies are available for Enterprise users

Licenses & Compliance

Compliance

Compliance status and certifications for the extension and its publisher

Microsoft

Microsoft provides resources indicating their preparation for CCPA compliance related to their products and services. However, there is no specific declaration on the parent company's CCPA compliance because Microsoft does not explicitly have a parent company identified in this context.

Compliant

Microsoft

Microsoft complies with HIPAA and enables its customers to adhere to HIPAA regulations, including the HITECH Act and the Security Rule requirements.

Compliant

Microsoft Corporation

Microsoft Corporation, including its services such as Azure, OneDrive for Business, and SharePoint Online, is certified as compliant with PCI DSS version 3.2 at Service Provider Level 1. This indicates that Microsoft is capable of handling vast amounts of payment card data securely. The compliance standards apply directly to these services, confirming their adherence to PCI DSS guidelines.

Compliant

Licenses

MIT License

View License

PLEASE NOTE: This is the license for the Python extension for Visual Studio Code. The Python extension automatically installs other extensions as optional dependencies, which can be uninstalled at any...