VS Code has no permission model. Any extension you install runs as ordinary Node.js with the full reach of your account: your files, your SSH keys, your terminal. Nothing had to ask, so nothing prompted you. ExtGuard audits the ones you already have, against 1,981 known-malicious records and 1,300 blocked publishers, for credentials hardcoded into shipped code, and for what each can reach. Runs entirely on your machine. No account, no telemetry, no network calls while scanning. Free and MIT.