Check O3 · provenance family · severity HIGH · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 ATLAS AML.T0111 Downloads that do not match the listing's history: the trust signal is the product, not a by-product.
The question this check asks: does this listing have more downloads than its age can explain? Ten thousand downloads on a listing that is under two weeks old is the shape O3 looks for.
A count that outruns the listing's age is either a real launch or traction that was arranged. On a registry where a namespace costs a sign-in, the second is the cheaper way to look established, and a reader who judges by the count is the one it is arranged for.
O3 compares downloadCount on the record with the first version's age (O2). At ovsx_traction_downloads (10,000) downloads or more on a listing under ovsx_traction_age_days (14) days old it is ovsx-traction-mismatch, HIGH, 10 points (the default weight; the scoring table has no row of its own for the Open VSX checks yet). When the history cannot be read, O3 is listed as not checked.
It fired on none of the 100 most-downloaded extensions measured on 1 November 2026: every one of them is older than two weeks. A genuine launch that is popular from its first day is a REVIEW until it is two weeks old.
Slow traction that turns. The four GlassWorm extensions Socket described on 31 January 2026 had more than 22,000 Open VSX downloads before their malicious releases. A listing that earns its count over months and turns afterwards is the shape O3 is built not to see. Ratings and reviews are not read.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '{downloadCount}'Put the count beside the first version's date from O2.
What counts as a mismatch? Ten thousand downloads or more on a listing whose first version is under fourteen days old.
Would O3 have flagged the January 2026 GlassWorm extensions? No. They gathered their downloads before they turned, which is the opposite shape; O3 had nothing to say about them.
Are ratings read? No. O3 reads the download count only.
V3 Traction mismatch — the Marketplace twin · O2 Extension age — where the age comes from.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.