extuno
VS Code extensions, checked before they run in your editor.
A VS Code extension runs with your editor's privileges. Extuno diffs each update and runs it live to catch workspace-trust abuse, task injection, and credential theft - static, dynamic, and AI analysis on every scan.
vs code plugin
Every finding is backed by evidence.
Each finding names the change, why it is dangerous, and the recommended action.
Workspace-trust abuse
An update auto-runs a task on folder open, before you opt in.
Credential theft
The extension reads ~/.aws and environment tokens and exfiltrates them.
New child process
A build step spawns a shell that was not present in the prior version.
From editor trust to token theft
Extuno runs the extension in a sandbox and records the exact chain from trust prompt to exfiltration.
- + Vulnerability and secret-leak testing on every version
- + Static analysis reads the code without running it
- + Dynamic sandbox runs it live and records behavior
- + AI code analysis reads the full source and correlates the change against prior versions
- 1Open workspace
- 2Extension requests trust
- 3Runs a build task
- 4Spawns hidden shell
- 5Exfiltrates ~/.aws + tokens
Scan your first VS Code plugin free.
Your first 5 credits are free - that is 5 full scans, no card required.
Common questions
Does Extuno support VS Code?
Yes. Extuno scans VS Code with static analysis, a dynamic sandbox, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.
How does Extuno scan VS Code?
Extuno acquires the published VS Code artifact, reads it statically with 1100+ rules, runs it in a network-segmented sandbox, reviews the source with AI, and diffs it against the prior version - naming the file, the change, why it is dangerous, and the fix.
What does Extuno catch in VS Code?
Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.
