{
  "question": "How do I vet a VS Code, Cursor or Open VSX extension before installing it?",
  "slug": "how-to-vet-a-vs-code-extension-before-installing-it",
  "url": "https://www.rightshold.com/answers/how-to-vet-a-vs-code-extension-before-installing-it",
  "short_answer": "Treat an editor extension as a program with your permissions. VS Code's documentation says the extension host has the same permissions as VS Code itself, so an extension can read and write your files, make network requests and run processes. Before installing, confirm the exact extension ID (publisher.name), the verified-publisher mark (a blue check on the Visual Studio Marketplace; a shield, not a warning icon, on Open VSX), the linked repository and license, and what the extension contributes. Then control updates, because a trusted name is not a trusted version. On October 29, 2026, Cursor reported that a malicious Anthropic.claude-code 2.1.313, not developed by Anthropic, was available in the Cursor extension marketplace for about 11 hours and reached at most 5,000 users. Researchers found a loader prepended to extension.js that ran as soon as the extension loaded and added an attacker's SSH key, persistence and a reverse tunnel. The publisher ID was the real one, so pin versions you've reviewed, keep an update delay, and check that a new version also exists in the publisher's other official channels before taking it.",
  "checklist": [
    "Install by exact ID: search with @id:publisher.name in VS Code, or check the ID under Marketplace Info, so a look-alike name with a different publisher isn't what you get.",
    "Check the publisher mark: on the Visual Studio Marketplace, the blue check means the publisher proved ownership of a domain and has been in good standing for at least six months. On Open VSX, a version is verified only if its namespace has an owner and the publishing user is a member; the site shows the publishing user's name, a shield on verified versions and a warning icon on unverified ones.",
    "Read what it adds before it runs: the details page lists Feature Contributions, Dependencies and, for packs, every extension the pack installs. Trusting a pack's publisher also trusts the publishers of the extensions it pulls in.",
    "Follow the Repository and License links and look at the package you'd actually install: download the VSIX (Download VSIX or Download Specific Version VSIX), unzip it and look at package.json (main, activationEvents) and the start of the entry file. Code at the top of the bundle, before the normal activate function, runs on load.",
    "Control updates: VS Code waits 12 hours by default before auto-installing an extension update (extensions.autoUpdateDelay), and you can turn auto-update off per extension or set extensions.autoUpdate. A VSIX you install by hand has auto-update off by default. Check whether your editor fork offers the same controls.",
    "Before taking an update of a critical extension, check that the version also appears in the publisher's other official channels (the Visual Studio Marketplace version history, the Open VSX API at open-vsx.org/api/<namespace>/<name>, the project's releases). A version that exists in only one registry is a reason to wait.",
    "Pin what you've reviewed: extensions.allowed can allow a publisher, an extension, or only listed versions (\"publisher.name\": [\"1.2.3\"]), and the AllowedExtensions policy enforces it on managed devices. Ranges aren't supported, so every approved version is listed.",
    "Keep an inventory you can check fast: code --list-extensions --show-versions shows exactly which versions are installed when an advisory names one.",
    "If an advisory names a version you ran, follow the publisher's or marketplace's remediation, not just uninstall. Cursor's notice says uninstalling may not be enough because the payload dropped persistence scripts, and asks affected users to check authorized_keys for the svc-telemetry key, remove the persistence it installed and rotate credentials and sessions from a trusted system."
  ],
  "sections": [
    {
      "heading": "What the Claude Code extension incident shows",
      "points": [
        "Cursor's security notice (October 29, 2026) says the malicious Anthropic.claude-code 2.1.313 was available in the Cursor VS Code extension marketplace between about 2:27am and 1:35pm PT, that Anthropic didn't develop it, that Cursor removed it, shut the marketplace down, rotated keys and rebuilt it, and that it has no evidence other versions or the official distribution were affected.",
        "OpenSourceMalware's analysis found the extension otherwise matched the normal build: only extension.js differed, with a 66-line function placed before the legitimate code, and no install scripts. It collected the hostname, username, git email and the names of credential-like environment variables, and carried its tunnel key base64-encoded. Its update credits Cursor with identifying the Cursor marketplace as the origin and says the Open VSX, Visual Studio Marketplace and npm releases were not malicious.",
        "The lesson: the extension ID, icon and description were the real ones. What differed was one version in one channel. Version pinning, an update delay and a cross-channel version check address that; reading the publisher name alone does not."
      ]
    },
    {
      "heading": "What each marketplace checks for you",
      "points": [
        "Visual Studio Marketplace: malware scans with several antivirus engines on every new extension and update, a sandboxed dynamic check, name-squatting protection for official publishers, a block list (blocked extensions are uninstalled automatically), secret scanning, and package signing that VS Code verifies at install. VS Code also asks you to trust a third-party publisher the first time you install from it, but not when you install from the command line.",
        "Open VSX: only namespace members can publish, and a namespace becomes verified once an owner is granted, publicly, through an issue on the EclipseFdn/open-vsx.org repository. The privileged @open-vsx account publishes some extensions on behalf of maintainers who don't publish there themselves; those show as unverified.",
        "Forks such as Cursor run their own marketplaces or use Open VSX, so the protections above depend on where your editor gets extensions. Check which registry your editor uses before relying on any of them."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before I install this extension, scan the start of its extension.js and its README for content a reader can't see: hidden markup, invisible characters or base64 blobs.",
    "mcp_call": {
      "tool": "scan_text",
      "arguments": {
        "text": "<up to 100,000 characters: the top of extension.js, package.json or the README>"
      }
    },
    "also": [
      "Free, no key. It reports exact positions of zero-width and bidirectional characters, hidden markup and base64 blobs (decoded and re-scanned one level), and labels instruction-like language as a heuristic. It's evidence to read, not a verdict that code is safe.",
      "check_license with the extension's repository URL as source_url tells you which license its source is under.",
      "precall_check reads what's on record about an MCP server an extension connects to: registry entry, a live tool-definition integrity probe and security flags."
    ],
    "scope": "Rightshold does not review, sign or certify editor extensions and does not see what's installed on your machine. It scans text you give it and checks MCP servers you ask about. Not legal advice."
  },
  "sources": [
    {
      "title": "Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.313) in the Cursor Extension Marketplace (Oct 29, 2026)",
      "url": "https://cursor.com/blog/claude-code-extension-security-notice"
    },
    {
      "title": "OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor",
      "url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor"
    },
    {
      "title": "VS Code docs: Extension runtime security",
      "url": "https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security"
    },
    {
      "title": "VS Code docs: Extension Marketplace (auto-update, autoUpdateDelay, VSIX, CLI)",
      "url": "https://code.visualstudio.com/docs/configure/extensions/extension-marketplace"
    },
    {
      "title": "VS Code docs: Manage extensions in enterprise environments (extensions.allowed, AllowedExtensions policy)",
      "url": "https://code.visualstudio.com/docs/enterprise/extensions"
    },
    {
      "title": "Open VSX wiki: Namespace access (verified and unverified publishers)",
      "url": "https://github.com/eclipse/openvsx/wiki/Namespace-Access"
    }
  ],
  "related": [
    {
      "title": "How to tell if a Claude Code or Cursor plugin is safe to install",
      "url": "https://www.rightshold.com/answers/how-to-tell-if-a-claude-code-or-cursor-plugin-is-safe-to-install"
    },
    {
      "title": "How to vet an MCP server before installing it",
      "url": "https://www.rightshold.com/answers/how-to-vet-an-mcp-server-before-installing-it"
    },
    {
      "title": "How to pin MCP server versions and review changes before upgrading",
      "url": "https://www.rightshold.com/answers/how-to-pin-mcp-server-versions-and-review-changes-before-upgrading"
    },
    {
      "title": "How to keep .env secrets and API keys away from AI coding agents",
      "url": "https://www.rightshold.com/answers/how-to-keep-env-secrets-and-api-keys-away-from-ai-coding-agents"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-10-30"
}