Check O1 · provenance family · severity HIGH · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 ATLAS AML.T0111 ATLAS AML.T0073 Open VSX's `verified` is its publisher signal: the publishing user belongs to a namespace that has an owner. Without it, the namespace at the top of the listing is a claim.
The question this check asks: does Open VSX mark this version of the extension verified? On Open VSX that word means one thing: the user who published the version is a member of the extension's namespace, and the namespace has an owner (or the user is one of Open VSX's privileged users). It is not a domain check and not a review.
Open VSX signs a publisher in through a GitHub account, and a namespace costs nothing to create. Without an owner, the name at the top of a listing is a claim nobody has had to defend. Socket's account of GlassWorm v2 on 25 April 2026 described 73 sleeper clones on Open VSX published under namespaces created at the start of April 2026, from GitHub accounts with one or two public repositories: nothing tied those publishers to anyone.
Ownership is the one provenance signal Open VSX puts on every record. That is why O1 exists, and why it is graded by the listing's age rather than fired on every unverified namespace.
O1 reads verified on the latest version's record. When it is false the finding is ovsx-unverified, and the publishing user's login is printed beside it. On a listing whose first version is under 90 days old (ovsx_established_days) it is HIGH; on an established listing it is a note with no points. The scoring table has no row of its own for the Open VSX checks yet, so the default weights apply: 10 points for a high finding, 4 for a medium one, 25 for a critical one, none for a note. A REVIEW verdict is a warning under every shipped profile, and on the preflight an ask before the install runs.
In the 1 November 2026 measurement of Open VSX's 100 most-downloaded extensions, 98 were verified. One of the two that were not is established, so O1 is a note there; the other was first published 30 days before the run, and O1 at HIGH is half of the measurement's single REVIEW. A new extension from a developer who has not claimed ownership of the namespace is a REVIEW for its first 90 days on this check alone. That is the price of weighting the campaign shape, and it is stated here.
A real member's stolen token. In the original GlassWorm wave of October 2025, stolen publisher tokens were used to push malicious versions through existing publishers on Open VSX; the Eclipse Foundation's update of 27 October 2025 records the tokens being revoked. Those versions were published by exactly who they had always been, and O1 passes them by construction. A change of publisher between versions: O1 reads the latest version only, so a namespace that changed hands is not compared with its history.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '{verified, publishedBy: .publishedBy.loginName, namespace}'Read verified. Then put it beside the extension's age (O2) and its source repository (O5): unverified and established is ordinary; unverified, new and with no source is the shape this page opened with.
Is an unverified namespace a red flag? Not on its own. On an established listing O1 is a note with no points; it is a high finding only on a listing whose first version is under 90 days old, where nothing ties a new publisher to the name it publishes under.
Is Open VSX's verified the same as the Marketplace's blue check? No. The Marketplace's check (V1) is a DNS record on a domain the publisher controls. Open VSX has no domain verification: its verified means the publishing user is a member of a namespace that has an owner.
Does a verified namespace make the extension trustworthy? No. It ties a publisher to a name; it says nothing about intent or about what the package does. A stolen token publishes as a verified member, and the code bundle is not read on this tier.
V1 Publisher verification — the same question on the VS Code Marketplace, answered by a domain · O2 Extension age — the other half of new and unverified · O5 Source repository — what an unverified publisher can still offer.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.