Audit all your VS Code extensions in one paste.

After the GitHub breach, you should know what's running inside your editor. ExtensionAudit checks your entire installed list for unverified publishers and stale extensions, instantly, no install required.

1. 1

   Run in terminal

   code --list-extensions
2. 2

   Paste the output

   into the box below
3. 3

   See your risk report

   per extension, in seconds

Zeeshan Tofiq

Full Stack Developer

Add to Favorites

Share

How ExtensionAudit works

The whole audit happens in the page you are looking at. There is no install, no OAuth prompt, and no server of ours in the path between your extension list and the marketplace.

1. 1

   You export your installed extension list

   Run code --list-extensions in any terminal. VS Code prints one extension ID per line in publisher.name form. That list is the complete inventory of what can execute inside your editor, which is the thing being audited.

2. 2

   The pasted text is parsed into extension IDs

   Each line is trimmed, blank lines and lines beginning with a hash are dropped, and everything before the first dot becomes the publisher. IDs are lowercased and de-duplicated, so pasting the same list twice does not double the work. The counter in the corner of the box shows how many valid IDs were recognised.

3. 3

   The IDs are queried against the VS Code Marketplace

   The IDs are sent in batches of 50 to the public marketplace gallery API, straight from your browser, with all batches running in parallel. Nothing is routed through a Dev Encyclopedia server, so we never see the list.

4. 4

   Three facts are pulled back for every extension

   Whether the publisher carries the verified badge, the total install count, and the date the latest version was published. Anything the marketplace does not recognise comes back as not found rather than being silently dropped.

5. 5

   A risk level is derived from verification plus staleness

   Unverified and last published over a year ago is red. Unverified, or last published over six months ago, is yellow. Verified and published within six months is green. Install count is shown for context but does not change the level, because popularity is not the same as safety.

6. 6

   Results are sorted worst first and can be exported

   The table puts red at the top, then yellow, then unknown, then green, so the extensions that need a decision are the ones you see first. Export CSV writes the same data to a file for a ticket, an audit trail, or a team review.

What the risk signals mean

What to do with each result

Input format reference

The parser expects one extension ID per line in publisher.name form, which is exactly what the VS Code CLI prints. The counter in the corner of the input box shows how many valid IDs were recognised, so you can confirm the paste worked before running the audit.

# VS Code
code --list-extensions

# Forks use the same flag
cursor --list-extensions
codium --list-extensions
code-insiders --list-extensions

# Copy straight to the clipboard
code --list-extensions | pbcopy        # macOS
code --list-extensions | clip          # Windows
code --list-extensions | xclip -sel c  # Linux

# Versions are not needed, strip them if you have them
code --list-extensions --show-versions | cut -d@ -f1

ms-python.python          # standard form, counted
esbenp.prettier-vscode    # hyphens in the name are fine
  dbaeumer.vscode-eslint  # leading spaces are trimmed
MS-Python.Python          # case is normalised to lowercase

# lines starting with a hash are treated as comments

ms-python.python          # a repeat of an earlier ID is dropped
prettier                  # no dot, so this line is ignored

IDs are queried in batches of 50, all batches in parallel, so a list of 120 extensions is three requests to the marketplace and takes about as long as one.

When to use ExtensionAudit

The tool is most useful at the moments when your editor's extension list changes, or when someone needs evidence that it was reviewed.