Process, network, filesystem, credential, webview and agent behavior deductions.
Recorded with source and analyzer provenanceDetection catalog · ruleset 2026.07.19
Inspect what the scanner can actually detect.
Search the deterministic rules behind report evidence, see which analyzer emits each signal, and understand the artifact surface it covers. A rule match remains evidence—not an automatic vulnerability claim.
40registered rules
11detection engines
8evidence classes
2026.07.19active ruleset
Analysis surfaces
Where report evidence comes from.
These are inspection boundaries, not grades. The report groups their output into reviewable behavior and keeps missing analyzer coverage visible.
Lifecycle, mutable sources, registry intelligence and release provenance.
Recorded with source and analyzer provenanceResolved direct and transitive runtime packages plus known advisories.
Recorded with source and analyzer provenanceExact hashes, signatures, native payloads, packed content and evasion indicators.
Recorded with source and analyzer provenanceVerification, maintenance, repository and security-policy context.
Recorded with source and analyzer provenanceExecutable coverage and successful completion of required analyzers.
Recorded with source and analyzer provenanceConfirmed intelligence
Known-bad artifacts and malicious dependencies.Exact package and file SHA-256 matches, configured threat intelligence, and dependencies identified as malicious.
Reviewer use: This is authoritative evidence and can directly drive a BLOCK decision when the intelligence source and artifact identity are valid.
artifact SHA-256feed sourcematched dependencyBehavior chains
Sources connected to security-sensitive sinks.Workspace input, webview messages, decoded payloads, credential surfaces, downloads, process execution, filesystem access, and outbound network transfer.
Reviewer use: Correlation is stronger than counting isolated API names. A source-to-sink path explains how a capability could become abuse.
sourcesinkfile and linecorrelation ruleCode and evasion
Dynamic calls, constructed arguments, and hidden content.AST-resolved bracket notation, computed call targets, encoded dynamic execution, invisible Unicode controls, obfuscation, and dynamic code loading.
Reviewer use: Attackers can evade plain-text matching. Structural parsing and signatures recover signals that regex alone misses.
AST noderesolved valueYARA matchcode locationCapability surface
What extension code is able to reach.Process execution, shell invocation, network and filesystem access, install scripts, agent tooling, native code, and packed artifacts.
Reviewer use: Capability is not proof of intent, but it defines blast radius and tells reviewers where explicit user intent and isolation are required.
capabilityactivation contextentrypointreview guidanceCredential and data exposure
Secret capture, storage, control, and transfer paths.Credential prompts and configuration keys, extension state storage, command surfaces, clipboard access, and flows into files, processes, or networks.
Reviewer use: IDE extensions share a privileged user environment. Insecure storage and cross-extension control can expose secrets even without malware.
secret sourcestorage surfacecontrol surfacetransfer sinkDependency security
Malicious or vulnerable runtime packages.Runtime dependency inventory is checked against configured vulnerability and malicious-package intelligence.
Reviewer use: A clean extension entrypoint can still inherit exploitable or malicious behavior through its dependency graph.
packageversionadvisoryfix versionArtifact and provenance
The exact bytes, packaging, and marketplace history.Package and file hashes, native and packed payloads, embedded PE content, and marketplace removal signals.
Reviewer use: A name or repository is not the artifact. Exact hashes and packaging evidence make a decision reproducible across machines and releases.
package hashfile hashesartifact typemarketplace signalAI, agent, and MCP
Tools that let models act inside the IDE.Language-model tools, chat participants, MCP server surfaces, agent data access, and network or execution combinations.
Reviewer use: Agent tools turn prompts into actions. Their approval, filesystem, terminal, and network boundaries need explicit review.
tool contributionMCP surfacedata accessaction sinkWebview boundaries
Browser-like messages entering extension privileges.Message events from webviews are traced toward process execution and other privileged extension APIs.
Reviewer use: A webview is a lower-trust input boundary; schema validation and narrow message handlers are essential.
message sourcehandlerexecution sinklocationIDE client posture
Whether local settings weaken IDE guardrails.Workspace Trust, broad trusted paths, automatic tasks, agent auto-approval, terminal and URL approval rules, and untrusted-workspace overrides.
Reviewer use: Extension findings answer what a package can do. Posture metrics answer whether local policy makes that behavior easier to trigger.
control status0-100 posture pressureclientremediationAnalysis coverage
What was inspected, skipped, or unsupported.Declared and discovered entrypoints, files inspected, provider availability, parse failures, truncation, archive limits, and unsupported native code.
Reviewer use: No findings is meaningful only when coverage is complete. Missing mandatory analysis produces INCOMPLETE, not ALLOW.
entrypoint coverageprovider statusskipped filescompletion stateRelease change
What changed since the trusted baseline.Decisions, findings, capabilities, dependencies, entrypoints, file hashes, and package identity are compared between versions.
Reviewer use: Trust is version-specific. A low-risk update can add one new execution path or replace a binary without changing the product name.
new findingsremoved findingscapability deltahash deltaEvidence taxonomy
Strength describes evidence, not certainty.
Evidence class controls how a finding can affect policy. Severity describes potential impact. Neither is a calibrated probability that an extension is malicious.
Authoritative artifact or package intelligence. May directly drive BLOCK.
Multiple related signals or a source-to-sink path. Usually drives REVIEW and may block under strict policy.
Behavior recorded by an external controlled analysis provider. Not produced by the hosted static path.
Known vulnerability or package intelligence attached to a resolved runtime dependency.
Artifact, marketplace, repository, or release-origin evidence.
A sensitive power or structural behavior that requires context and user-intent review.
A secret storage, input, command, or cross-extension boundary that may weaken isolation.
A single common static indicator. Context only; never sufficient for a malware claim by itself.
Authoritative registry
Detection rule catalog
40 of 40 rules shown. Findings retain the rule id, file, line, evidence class, severity, and engine output where available.
RuleEvidenceSeverityEngine
known-bad-artifactKnown-bad artifactExact package or file hash matched configured malicious intelligence.
confirmed intelligencemalicious-npm-dependencyMalicious npm dependencyA runtime dependency is identified as a malicious package.
dependencymarketplace-removed-packageMarketplace removed packageThe package appears in a marketplace removal list.
provenancevulnerable-npm-dependencyVulnerable npm dependencyRuntime dependency intelligence reports a known vulnerability.
dependencyuntrusted-workspace-input-to-processWorkspace input reaches process executionWorkspace or user configuration reaches a process execution API; common developer-tool behavior that requires shell and trust context.
executionwebview-message-to-processWebview message reaches executionWebview-controlled message data reaches process execution.
webviewdecoded-payload-executionDecoded payload reaches dynamic executionDecoded or deobfuscated data flows into dynamic execution.
codeencoded-dynamic-executionEncoded dynamic executionEncoded payload handling appears with dynamic execution markers.
codeunicode-evasionUnicode source-code evasionExecutable content contains bidirectional or invisible Unicode controls.
codeembedded-pe-artifactEmbedded portable executablePortable executable content is embedded inside another artifact.
artifactast-bracket-notation-sensitive-accessBracket access to sensitive globalComputed bracket notation resolves to eval, Function, require, or child_process.
codeast-constructed-dynamic-argumentConstructed argument to dynamic sinkA dynamic execution argument is assembled at runtime to hide a suspicious target.
codeast-dynamic-call-targetDynamic call targetA computed member is invoked instead of a literal function target.
executioncredential-dataflow-to-networkCredential data flow to networkCredential-related sources occur with outbound network sinks.
credential exposurecredential-dataflow-to-fileCredential data flow to fileCredential-related sources occur with file writes.
credential exposurecredential-dataflow-to-processCredential data flow to processCredential-related sources occur with process execution.
credential exposurecredential-exfiltration-chainCredential exfiltration chainCredential references, local reads, and outbound transfer occur together.
credential accessclipboard-read-near-secret-inputClipboard read near secret inputClipboard reads occur near credential input or storage surfaces.
credential exposurecredential-command-controlCredential command controlCredential input appears near cross-extension command or state control.
credential exposurecredential-config-updateCredential configuration storageCredential-related values are written to VS Code configuration.
credential exposurecredential-global-state-storageCredential global state storageCredential-related values are written to global or workspace state.
credential exposurecredential-inputbox-promptCredential InputBox promptAn InputBox appears to request credential material.
credential exposurecredential-command-executionCredential command executionA credential-related VS Code command is executed.
credential exposurecredential-config-keyCredential configuration keyConfiguration keys or descriptions appear credential-related.
credential exposurecredential-global-state-keyCredential global state keyExtension state keys appear credential-related.
credential exposurecredential-command-registrationCredential command registrationA contributed command identifier or label appears credential-related.
credential exposureagent-data-exfil-chainAgent data exfiltration chainAgent-facing code, sensitive references, and outbound network behavior occur together.
agenticagentic-toolingAgent-facing IDE capabilityThe extension contributes model tools, chat participants, or MCP surfaces.
agenticdownload-and-executeDownload and executeA source file combines network download and local process execution.
executionlifecycle-scriptLifecycle scriptThe package defines install or uninstall lifecycle scripts.
supply chainnative-or-packed-artifactNative or packed artifactThe package contains native binaries or packed archives.
artifactdynamic-shell-executionDynamic shell executionCode invokes a shell-style process execution API.
executionuntrusted-input-executionUntrusted input executionIDE or workspace input appears with process execution.
executiondynamic-code-loadingDynamic code loadingCode uses dynamic loading or evaluation patterns.
codedestructive-file-patternDestructive file patternCode contains destructive file-operation patterns.
filesystemsafe-configured-cli-executionConfigured CLI executionA configured local CLI is invoked with execFile-style execution.
executionfilesystem-accessFilesystem accessCode reads or writes local files; common in developer tools.
filesystemnetwork-accessNetwork accessCode performs network requests; not malicious by itself.
networkobfuscationObfuscationSource contains obfuscation indicators.
codeprocess-executionProcess executionCode can spawn local processes; common for language servers and debuggers.
execution