Hundreds of malicious extensions are released on the VSCode Marketplace. VSCan analyzes these extensions to determine if they are malicious or vulnerable. Powered by LLMs, ASTs, and static analysis, it has already found hundreds of compromised extensions.