← VS Code Extension Drift Check
Different moments: vsix-audit vets a named .vsix file for malware indicators before you install it. This tool diffs two point-in-time snapshots of extensions you already have installed and trust, to name exactly what changed or what quietly disappeared from the marketplace since your last check.
vsix-audit is an open-source security scanner from
Trail of Bits that you point at one named extension. It statically
analyzes that .vsix file's code with AST-based pattern
matching and YARA rules built from indicators of compromise drawn from
known campaigns — GlassWorm and others among them — and
reports findings as text, JSON, or SARIF, which fits it naturally into
a CI gate on a specific package. It is a pre-install tool: the
question it answers is whether a named extension looks safe to install
in the first place, based on what its code actually contains.
This tool does none of that. It never downloads, unpacks, or statically
analyzes an extension's code — it has no opinion at all about
whether a given .vsix file is safe to install. What it
does instead is read two snapshots of your own already-installed
extension set (the output of node cli.mjs snapshot, or the
plain output of code --list-extensions --show-versions)
and diff them, naming exactly which extensions gained a new activation
trigger, a new dependency, or a changed entry point since the older
snapshot — plus a separate, CLI-only live check for whether an
installed id still resolves on the VS Code Marketplace at all. It is a
post-install, point-in-time tool, and the moment it targets is
the one that mattered in both GlassWorm and the Nx Console compromise:
extensions that were already trusted and running before anything
changed.
| Question | Where to answer it |
|---|---|
| Is this specific extension safe to install, based on what its code actually does? | vsix-audit — that is the pre-install code-scanning job it is built for. |
| Did an extension I already installed and trust change its activation surface since I last checked? | This tool — paste two snapshots, get the diff, nothing installed or scanned. |
| Is an extension I already installed still on the marketplace, or was it quietly pulled? | This tool's CLI-only check command — a live, factual resolution lookup, not a code scan. |
| I want YARA-rule and AST-based static analysis of an extension's actual code before I install it. | vsix-audit — this tool never inspects extension code at all. |
| I want a CI gate on my whole team's already-installed extension set, not one named package. | This tool — node cli.mjs diff baseline.json current.json exits non-zero on drift. |
A team can reasonably run both: vsix-audit before adding a new extension to an allowlist, and this tool on a schedule against the whole already-installed set, to catch the drift or delisting that happens after an extension has already been trusted and approved. This page makes no claim about vsix-audit's detection accuracy either way — it only describes its documented shape and states what this tool does differently. Neither tool's clean result is a guarantee of safety.
This tool needs no account and no sign-in: it is a static page, the diff runs in your browser (or as a stdlib-only CLI script for snapshot/diff), and both keep working with the network off.
Not in the way this tool does. vsix-audit, from Trail of Bits, is a scanner you point at one named .vsix file: it statically analyzes that file's code with AST-based pattern matching and YARA rules built from IOCs of known campaigns (GlassWorm and others), and reports text, JSON, or SARIF output, typically before you install the extension or as a CI gate on a specific package. It does not track your installed set over time. This tool does the opposite and narrower job: it never inspects an extension's code at all, and instead diffs two point-in-time snapshots of your own already-installed extensions to name exactly which ones changed their declared activation surface since an earlier snapshot, plus a separate live check for whether an installed id still resolves on the VS Code Marketplace.
They answer different questions, and a team can reasonably run both. vsix-audit answers "should I install this specific extension" by inspecting its code for malware indicators before it ever runs on your machine. This tool answers "did something I already installed and trust just change, or get pulled from the marketplace since I checked" — the question that matters after installation, which is also the mechanism behind the GlassWorm and Nx Console incidents: both involved extensions that were already trusted and installed before anything went wrong. Free, no account, no code sent anywhere either way.
No. This page is not affiliated with, endorsed by, or sponsored by Trail of Bits. vsix-audit is a project of Trail of Bits, named here only to describe what this tool is and is not, based on its own public GitHub repository and documentation.
Open VS Code Extension Drift Check to diff your own installed set, or read why VS Code doesn't warn you when an extension is delisted for the full mechanism and how to wire the CLI into CI.