← VS Code Extension Drift Check
Different moments entirely: VSCan scans a named extension's code once, before you install it, to flag malware and excessive permissions. This tool diffs your already-installed extensions against an earlier snapshot to flag exactly what changed about them after you already trusted and installed them, or whether one you have was later pulled from the Marketplace.
VSCan is a free, no-login static scanner. Its own site describes pasting in an extension's name or identifier and running a deep analysis of that extension's code, permissions, dependencies, and declared network activity, entirely before you install it — checking for malware and spyware, exploitable vulnerabilities, supply-chain risk inherited from dependencies, permission abuse, and privacy concerns. VSCan's own documentation is explicit that a scan is a starting point for review, not a guarantee, and that it can flag code it does not fully understand the intent of.
This tool does none of what VSCan does: it never downloads or inspects an extension's code, and it has no idea whether any single extension is malicious. It only compares two point-in-time snapshots of what you already have installed — by publisher, name, and version — to name exactly which ones changed their declared activation surface (a new startup trigger, a new dependency, a changed entry point) since an earlier snapshot, or a CLI-only live check of whether an installed extension's identifier still resolves on the VS Code Marketplace at all. That second question is exactly what let the GlassWorm and Nx Console incidents keep running on machines that had already installed a trusted-looking extension before it turned malicious or was pulled.
| Question | Where to answer it |
|---|---|
| I'm about to install a new extension and want to know if its code looks malicious first. | VSCan — that is exactly the pre-install job it is built for. |
| I want to know whether any of the extensions I already have installed changed their activation surface since I last checked. | This tool — paste an older and a newer snapshot, get the diff. |
| I want to know whether an extension I've had installed for months was quietly pulled from the Marketplace. | This tool's CLI check command — VSCan scans code, not Marketplace listing status over time. |
| I want a deep static analysis of one named extension's permissions, dependencies, and network calls. | VSCan — this tool never reads an extension's code at all, only its declared manifest fields across two snapshots. |
| I want a one-time diff of exactly what changed between two lists of installed extensions, with no code scan involved. | This tool — that is the whole job, and the only one it does. |
A developer can reasonably use both, at different moments: VSCan before installing anything new, and this tool afterwards, on a schedule or in CI, to catch a silent change to what you already trust. This page does not evaluate VSCan's scan accuracy and makes no claim about it either way — it only describes VSCan's documented product shape and states what this tool does differently. A clean result from either one is not a security guarantee.
This tool needs no account and no sign-in: the browser page and the CLI's snapshot/diff commands make no network calls at all, and the CLI's separate check command talks to the network only from your own machine, only when you run it.
Not in the way this tool does. VSCan's own site describes a one-shot static analysis: you give it an extension's identifier and it downloads and inspects that extension's code, permissions, dependencies, and declared network activity once, before you install it, to flag malware, spyware, exploitable vulnerabilities, supply-chain risk, and excessive permissions. That is a pre-install check on a single named extension. This tool does the opposite and narrower thing: it never scans an extension's code at all, and instead diffs two point-in-time snapshots of your own already-installed extension list, by publisher and version, to name exactly which ones changed their declared activation surface, or were later pulled from the Marketplace, after you already trusted and installed them.
They answer different questions and a developer can reasonably use both. VSCan answers "is this specific extension safe to install", with a deep, free, one-time code scan of that extension's bundle before it runs on your machine. This tool answers "did anything about my already-installed extensions change since I last checked, or did one of them get pulled from the Marketplace after the fact" — the exact gap that let the GlassWorm and Nx Console campaigns keep running on machines that had already installed a trusted-looking extension. Screen a new extension with VSCan before installing it, then use this tool afterwards to catch a silent change to what you already trust.
No. This page is not affiliated with, endorsed by, or sponsored by VSCan. It is named here only to describe what this tool is and is not, based on VSCan's own publicly documented product.
Open VS Code Extension Drift Check to diff your own extensions, or read why VS Code doesn't warn you when an extension is delisted for the full mechanism and how to wire the CLI into CI.