[scintx-dev] vsix-audit as a potential SCINTX security service

[Max Ammann <maximilian.ammann@xxxxxxxxxxxxxxx>]

Hi everyone,

I’m Max from Trail of Bits. A member of the Eclipse community
suggested bringing an idea to this list: using vsix-audit [1] to scan
extensions for Open VSX through SCINTX.

vsix-audit analyzes VS Code extension packages for suspicious patterns
and known indicators. It is available as a Docker image and can
produce JSON and SARIF output.

We recently looked at the malicious Claude Code extension distributed
through Cursor’s marketplace [2] and found indicators of compromise in
the package. We were wondering how scanning VS Code extensions,
including those on Open VSX, fits into SCINTX’s work. If SCINTX
already provides an interface for this, it could be interesting to
explore whether vsix-audit could use it today.

Thanks,
Max

[1] https://github.com/trailofbits/vsix-audit
[2] https://cursor.com/blog/claude-code-extension-security-notice