AI · alternatives · 2026
24 alternatives to VSCan - Detect Malicious VSCode Extensions
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
VSCan is a free security scanning tool for VSCode, Cursor, and Windsurf extensions that detects malware, obfuscated code, dangerous permissions, vulnerable dependencies, and suspicious network activity. Built by a… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
An open source security scanner for Visual Studio Code
2020 · snyk.io · its alternatives →
- 2
Koidex▲380Know if a package, extension, or AI model is actually safe
Feb 2026 · dex.koi.security · its alternatives →
- 3
Learn more about Snyk’s security plugins for JB, VS Code, Eclipse, and Visual Studio that provide real-time vulnerability scanning and actionable fix advice.
2020 · snyk.io · its alternatives →
- 4
VScanX▲11Deterministic security scanner with zero false positives
May 2026 · vscanx.vercel.app · its alternatives →
- 5
SusCode▲13A VS Code extension that scans for potential security risks.
2024 · marketplace.visualstudio.com · its alternatives →
- 6
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com · its alternatives →
- 7
VS Code extension that encourages you to take a break. - schneefux/vscode-winddown
2020 · github.com · its alternatives →
- 8
SafeDep Vet▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
- 9CG
There is a growing problem with VSCode extensions: - they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture So I've been working on a way to help mitigate some of these risks Right now, only an MVP of a "CLI" is available: $ code…
2023 · its alternatives →
- 10
ThreatSlayer▲85Free enterprise grade security for your personal browser
2023 · chromewebstore.google.com · its alternatives →
- 11
A cheatsheet to help you remember keybinds for VSCode
2020 · chromewebstore.google.com · its alternatives →
- 12
aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.
2015 · appcanary.com · its alternatives →
- 13
Track browser extension installations / threats in real-time
2019 · extensionmonitor.com · its alternatives →
- 14FL
Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40%…
2025 · its alternatives →
- 15
Hey HN, I built an automated system that tracks malicious Chrome/Edge extensions daily. The database updates automatically by monitoring chrome-stats for removed extensions and scanning security blogs. Currently tracking 1000+ known malicious extensions with extension IDs, names, and dates. I'm working on detection tools (GUI + CLI) to scan locally installed extensions against this database, but wanted to share the raw data first since maintained threat intelligence lists like this are hard to find. The automation runs 24/7 and pushes updates to GitHub. Free to use for research,…
Feb 2026 · github.com · its alternatives →
- 16
This is a spiritual adaptation of oil.nvim for vscode. The main idea is you edit the filesystem by editing the current directory listing's text buffer. For example, if I want to rename a file, I just rename it in the listing file. This is extremely powerful because it translates all of your text-editing skills immediately into file editing capabilities. Some features: * Create/rename/move/delete files by editing the current directory listing's textbuffer * Filter using glob pattern * Trash and undo support * Works even in remote-ssh workspaces * Works across multiple vscode…
2025 · github.com · its alternatives →
- 17
Navigate in file-system-based router projects easily
2021 · marketplace.visualstudio.com · its alternatives →
- 18
Hi, I'm Alex - the creator of STRICH (https://strich.io), a barcode scanning library for web apps. Barcode scanning in web apps is nothing new. In my previous work experience, I've had the opportunity to use both high-end commercial offerings (e.g. Scandit) and OSS libraries like QuaggaJS or ZXing-JS in a wide range of customer projects, mainly in logistics. I became dissatisfied with both. The established commercial offerings had five- to six-figure license fees and the developer experience was not always optimal. The web browser as a platform also seemed not to be the main…
2023 · strich.io · its alternatives →
- 19
A quick and easy file sharing tool built on privacy
2021 · marketplace.visualstudio.com · its alternatives →
- 20
Live extension analysis: Point us at a Chrome/Edge/Firefox extension (store URL or CRX). We spin up a safe sandbox and observe it in real time—permissions use, message passing, storage writes, network calls, remote code loading, and UI injections. Package scanning: Paste an npm/package URL or code. We do quick static + dynamic checks: install/postinstall scripts, obfuscation/eval, exfil endpoints, suspicious APIs, and typosquat/reputation signals. AI explainer: An LLM summarizes the behaviors and risk patterns in plain English (why it’s risky, what to verify,…
2025 · browsertotal.com · its alternatives →
- 21
Extension for Visual Studio Code - Magit for Visual Studio Code
2020 · marketplace.visualstudio.com · its alternatives →
- 22IM
2024 · marketplace.visualstudio.com · its alternatives →
- 23
Dastardly▲57A lightweight web app security scanner for your CI pipelines
2022 · portswigger.net · its alternatives →
- 24
CodeScan▲16Scan and secure your code to prevent future cyber threats.
2025 · codescan.dev · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →