VSCan - Detect Malicious VSCode Extensions
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
VSCan - Detect Malicious VSCode Extensions launched on June 24, 2025 with 52 votes, #544 of 7,999 launches that month and more than 90% of that year's launches. The site was still online in September 2026, 1 year on.
In plain words
VSCan is a free security scanning tool for VSCode, Cursor, and Windsurf extensions that detects malware, obfuscated code, dangerous permissions, vulnerable dependencies, and suspicious network activity. Built by a security researcher, it requires no login and generates developer-friendly reports about extension risks. The tool helps developers understand potential security threats before installing extensions that run with full system access.
written from the facts on this page · September 2026
From the sources
Hundreds of malicious extensions are released on the VSCode Marketplace. VSCan analyzes these extensions to determine if they are malicious or vulnerable. Powered by LLMs, ASTs, and static analysis, it has already found hundreds of compromised extensions.
Proactively analyze Visual Studio Code extensions for security vulnerabilities and ensure a safer development environment. Provide the VSCode Marketplace name or ID of the extension you want to analyze. Our system fetches and scrutinizes the extension's code, permissions, and metadata. Receive a comprehensive report detailing potential risks and recommendations. Quickly analyze commonly used extensions or search for specific ones above. Join thousands of developers who trust VSCan to keep their VSCode environmentfrom vscan.dev
In the maker’s words, at launch
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To…
Does a similar job
all alternatives →
VulnCost for Visual Studio Code2020 · snyk.io · ▲126An open source security scanner for Visual Studio Code
Vuln Cost – immersive VS Code extension to surface vulnerabilities2020 · snyk.io · ▲86Learn more about Snyk’s security plugins for JB, VS Code, Eclipse, and Visual Studio that provide real-time vulnerability scanning and actionable fix advice.
SusCode2024 · marketplace.visualstudio.com · ▲13A VS Code extension that scans for potential security risks.
SafeDep Vet2023 · safedep.io · ▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
More ai this month
the category →
Paintings by AI models: programs run through a simulation of oil paint.
AI · 20d ago · stillwet.art
PixVerse R2▲381A real-time world model you can explore and change
AI · 29d ago · world.pixverse.video
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, June 2025
the whole month →- IM
Hey HN! Pilots everywhere are required to keep a logbook of all their flying hours, aircraft, airports, and so on. Since I track everything digitally (some people still just use paper logbooks!), I put together some data visualizations and a few 3D globes to show my flying history. This globe is probably my favourite so far: https://jameshard.ing/pilot/globes/all If you’ve got ideas for other graphs or ways to show this kind of data, I’d love to hear them!
Life & fun · 2025 · jameshard.ing
Stunning presentations with AI. No design skills required.
AI · 2025 · chroniclehq.com
Build native mobile apps for iOS and Android without code.
Dev tools · 2025 · bble.io
All your connections, across all your socials.
AI · 2025 · pally.com
I was the main contributor to workout.lol, an open-source fitness app to easily build a workout routine. The project had traction (1.4k GitHub stars, 95 forks, ~20K visits/month), but was eventually sold due to video licensing hurdles. The new owner stopped maintaining it, and the repo went abandoned. Over the next 9 months, I sent 15 emails to try to save it : no replies. Feature requests & issues were ignored. The community was left with a "broken" tool let's say. I couldn't just let it die So I built the new version from scratch with the same open-source spirit, but a better…
Dev tools · 2025 · github.com