ext-scan

Local security scanner for VS Code and Cursor extensions. Checks what's already installed on your machine against known-compromised packages, suspicious code patterns, and optionally runs an AI deep analysis.

Why

VS Code and Cursor extensions run with full access to your terminal, filesystem, environment variables, and clipboard. There's no sandboxing. In 2026 alone: 73 fake extensions delivered GlassWorm malware, a poisoned extension led to GitHub's internal repos being stolen, and a Cursor extension drained $500K from a developer's crypto wallet.

Existing tools scan the marketplace or scan your code. Nothing scans the extensions themselves on your machine. ext-scan fills that gap.

Install

npm install -g ext-scan

Or run without installing:

npx ext-scan

Usage

# Standard scan (catalog + static analysis)
ext-scan

# Clean output — hide trusted publisher noise
ext-scan --no-info

# AI deep scan on flagged extensions (needs API key)
export ANTHROPIC_API_KEY=sk-ant-...
ext-scan --deep

# JSON output for piping to other tools
ext-scan --json

# Catalog check only (fastest)
ext-scan --catalog-only

# Verbose progress
ext-scan --verbose

How it works

Three layers, run in order:

Layer 1 — Catalog matching

Checks installed extensions against a maintained list of known-compromised packages. Exact ID + version matching. Zero false positives.

Layer 2 — Static analysis

Scans extension source code for 8 suspicious patterns:

Rule	Severity	What it catches
shell-exec	high	Shell command execution via child process APIs
eval-usage	high	Runtime code execution via eval
network-ip	high	HTTP requests to raw IP addresses
sensitive-file-read	high	References to SSH keys, AWS credentials, env files
crypto-wallet	high	Hardcoded cryptocurrency wallet addresses
base64-decode	medium	Hardcoded base64 strings being decoded
env-access	medium	Environment variable reads
clipboard-read	medium	Clipboard API access

Extensions from trusted publishers (Microsoft, Red Hat, etc.) are still scanned but findings are downgraded to info severity.

Layer 3 — AI deep scan

Sends extension manifest and source excerpts to Claude for behavioral analysis. Catches things regex can't: obfuscated code, suspicious capability combinations, typosquatting, persistence mechanisms.

Only runs on untrusted extensions that already have static findings. Requires ANTHROPIC_API_KEY.

Example output

ext-scan v0.1.0
Scanned 16 extensions at 2026-05-26T00:03:28.876Z

cweijan.vscode-office (12 findings)
  HIGH     [static/crypto-wallet] Contains cryptocurrency wallet address
  HIGH     [static/eval-usage] Uses eval — can execute arbitrary code
  HIGH     [ai/obfuscated-minified-code] Extension main entry point is heavily minified
  HIGH     [ai/suspicious-activation-event] Activates on every VS Code startup
  MEDIUM   [static/env-access] Reads environment variables
  MEDIUM   [ai/remote-code-execution-capability] Includes puppeteer-core dependency
  ...

tomoki1207.pdf (2 findings)
  HIGH     [static/eval-usage] Uses eval — pdf.js sandbox (likely benign)

Total: 6 high, 8 medium

Supported editors

• VS Code (~/.vscode/extensions/)
• Cursor (~/.cursor/extensions/)

macOS and Linux. Windows support not yet implemented.

Extending the catalog

Add entries to catalog/known-bad.json:

{
  "ecosystem": "vscode",
  "id": "publisher.extension-name",
  "versions": ["1.2.0"],
  "severity": "critical",
  "description": "What this extension does that's malicious",
  "reference": "https://link-to-advisory"
}

Omit versions to flag all versions of an extension.

Exit codes

Code	Meaning
0	No high or critical findings
1	High-severity findings present
2	Critical-severity findings present

License

Apache-2.0