I built this after noticing something obvious I had never actually thought about: I had 81 extensions installed and had read the source of none of them. VS Code has no permission model. No prompt, no sandbox, no list of what an extension asked for, because it never had to ask. The interesting part was not detection, it was restraint. My first version flagged 57 of my 82 extensions. That is not a security tool, that is a tool you learn to ignore, and then you ignore the one finding that mattered. Today it flags zero on the same machine and I trust it more for that. It will not catch a competent attacker. Pattern matching never does. It catches the careless majority: typosquats, credentials left in shipped code, and extensions pulled from the marketplace that are still sitting on your disk. Free, MIT, runs locally. If it flags something of yours incorrectly, send me the extension ID and I will fix it.

ExtGuard

Audit the VS Code extensions already running on your machine

Audit the VS Code extensions already running on your machine