extuno
Open VSX extensions, the same depth as VS Code.
Open VSX is the open registry behind VSCodium, Cursor, and Gitpod - reviewed less than the Microsoft Marketplace, so a poisoned extension slips in more easily. Extuno scans the .vsix with the full VS Code pipeline: static, dynamic, and AI analysis on every scan.
open vsx extension
Every finding is backed by evidence.
Each finding names the change, why it is dangerous, and the recommended action.
Workspace token theft
The extension reads a token from the workspace and sends it to an unlisted host.
Broad activation
It activates on every workspace, not a specific language or file.
Shell on activation
A child process runs at activation time with no user action.
Less review, same attack surface
Extuno runs the Open VSX .vsix live in a segmented micro-VM and records the shell and the beacon.
- + Vulnerability and secret-leak testing on every version
- + Static analysis reads the code without running it
- + Dynamic sandbox runs it live and records behavior
- + AI code analysis reads the full source and correlates the change against prior versions
- 1Extension installs from Open VSX
- 2Reads workspace files on activation
- 3Spawns a shell task
- 4Exfiltrates a token to a remote host
Scan your first Open VSX plugin free.
Your first 5 credits are free - that is 5 full scans, no card required.
Common questions
Does Extuno support Open VSX?
Yes. Extuno scans Open VSX with static analysis, a dynamic sandbox, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.
How does Extuno scan Open VSX?
Extuno acquires the published Open VSX artifact, reads it statically with 1100+ rules, runs it in a network-segmented sandbox, reviews the source with AI, and diffs it against the prior version - naming the file, the change, why it is dangerous, and the fix.
What does Extuno catch in Open VSX?
Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.
