How do I vet a VS Code, Cursor or Open VSX extension before installing it?

What should I check, step by step?

1. Install by exact ID: search with @id:publisher.name in VS Code, or check the ID under Marketplace Info, so a look-alike name with a different publisher isn't what you get.

2. Check the publisher mark: on the Visual Studio Marketplace, the blue check means the publisher proved ownership of a domain and has been in good standing for at least six months. On Open VSX, a version is verified only if its namespace has an owner and the publishing user is a member; the site shows the publishing user's name, a shield on verified versions and a warning icon on unverified ones.
3. Read what it adds before it runs: the details page lists Feature Contributions, Dependencies and, for packs, every extension the pack installs. Trusting a pack's publisher also trusts the publishers of the extensions it pulls in.
4. Follow the Repository and License links and look at the package you'd actually install: download the VSIX (Download VSIX or Download Specific Version VSIX), unzip it and look at package.json (main, activationEvents) and the start of the entry file. Code at the top of the bundle, before the normal activate function, runs on load.
5. Control updates: VS Code waits 12 hours by default before auto-installing an extension update (extensions.autoUpdateDelay), and you can turn auto-update off per extension or set extensions.autoUpdate. A VSIX you install by hand has auto-update off by default. Check whether your editor fork offers the same controls.
6. Before taking an update of a critical extension, check that the version also appears in the publisher's other official channels (the Visual Studio Marketplace version history, the Open VSX API at open-vsx.org/api/<namespace>/<name>, the project's releases). A version that exists in only one registry is a reason to wait.
7. Pin what you've reviewed: extensions.allowed can allow a publisher, an extension, or only listed versions ("publisher.name": ["1.2.3"]), and the AllowedExtensions policy enforces it on managed devices. Ranges aren't supported, so every approved version is listed.
8. Keep an inventory you can check fast: code --list-extensions --show-versions shows exactly which versions are installed when an advisory names one.
9. If an advisory names a version you ran, follow the publisher's or marketplace's remediation, not just uninstall. Cursor's notice says uninstalling may not be enough because the payload dropped persistence scripts, and asks affected users to check authorized_keys for the svc-telemetry key, remove the persistence it installed and rotate credentials and sessions from a trusted system.

What the Claude Code extension incident shows

Cursor's security notice (October 29, 2026) says the malicious Anthropic.claude-code 2.1.313 was available in the Cursor VS Code extension marketplace between about 2:27am and 1:35pm PT, that Anthropic didn't develop it, that Cursor removed it, shut the marketplace down, rotated keys and rebuilt it, and that it has no evidence other versions or the official distribution were affected.

• OpenSourceMalware's analysis found the extension otherwise matched the normal build: only extension.js differed, with a 66-line function placed before the legitimate code, and no install scripts. It collected the hostname, username, git email and the names of credential-like environment variables, and carried its tunnel key base64-encoded. Its update credits Cursor with identifying the Cursor marketplace as the origin and says the Open VSX, Visual Studio Marketplace and npm releases were not malicious.
• The lesson: the extension ID, icon and description were the real ones. What differed was one version in one channel. Version pinning, an update delay and a cross-channel version check address that; reading the publisher name alone does not.

What each marketplace checks for you

Visual Studio Marketplace: malware scans with several antivirus engines on every new extension and update, a sandboxed dynamic check, name-squatting protection for official publishers, a block list (blocked extensions are uninstalled automatically), secret scanning, and package signing that VS Code verifies at install. VS Code also asks you to trust a third-party publisher the first time you install from it, but not when you install from the command line.

• Open VSX: only namespace members can publish, and a namespace becomes verified once an owner is granted, publicly, through an issue on the EclipseFdn/open-vsx.org repository. The privileged @open-vsx account publishes some extensions on behalf of maintainers who don't publish there themselves; those show as unverified.
• Forks such as Cursor run their own marketplaces or use Open VSX, so the protections above depend on where your editor gets extensions. Check which registry your editor uses before relying on any of them.