llm-security/tests/fixtures/ide-extensions/root-mixed/wildcard.activator-1.0.0/package.json at d65bb70347f3ca1d1e696ff540489c570a93b2ba - open/llm-security - Forgejo: Beyond coding. We Forge.

open/llm-security

Kjell Tore Guttormsen acf0d8077d feat(llm-security): add /security ide-scan — VS Code / JetBrains extension prescan (v6.3.0)

New standalone scanner (prefix IDE) discovers installed VS Code extensions
across forks (Cursor, Windsurf, VSCodium, code-server, Insiders, Remote-SSH)
and runs 7 IDE-specific threat checks: blocklist match (CRITICAL),
theme-with-code, sideload (unsigned .vsix), dangerous uninstall hook (HIGH),
wildcard activation, extension-pack expansion, typosquat (MEDIUM).

Per-extension reuse of UNI/ENT/NET/TNT/MEM/SCR scanners with bounded
concurrency. Offline-first; --online opt-in. JetBrains discovery stubbed
for v1.1. 22 new tests (1296 total, was 1274).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 16:23:35 +02:00

11 lines

304 B

JSON

Raw Blame History

 {
   "publisher": "wildcard",
   "name": "activator",
   "version": "1.0.0",
   "displayName": "Wildcard Activator",
   "description": "Broad activation surface (non-theme, untrusted)",
   "engines": { "vscode": "^1.80.0" },
   "main": "./extension.js",
   "activationEvents": ["*"],
   "categories": ["Other"]
 }