Check O4 · provenance family · severity HIGH · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 OWASP LLM09 ATLAS AML.T0074 ATLAS AML.T0060 A Microsoft Marketplace name, display name or publisher republished on Open VSX by someone else — GlassWorm v2's clone shape, masquerading when a person reads it and a hallucinated entity when a model does.
The question this check asks: does this listing borrow the identity of a well-known VS Code Marketplace extension — its exact id, a name or publisher one edit away, or its display name under another publisher?
GlassWorm v2's clones were Marketplace names, display names and icons republished on Open VSX. The example pair in Socket's write-up of 25 April 2026 is the Marketplace's MS-CEINTL.vscode-language-pack-tr against the Open VSX impersonation Emotionkyoseparate.turkish-language-pack. In July 2025 Kaspersky described a fake “Solidity Language” extension on Open VSX that outranked juanblanco.solidity, and a replacement published under juanbIanco — a capital I. An editor that installs from Open VSX shows the user a familiar name, and the familiar name is the attack.
Unlike O1, O5 and O7, O4 does not wait for the listing's age: the clone shape is the campaign.
O4 compares the namespace, the extension name and the display name with the Marketplace's known extensions (backend/policy/vsx-known-publishers.json, the list V4 uses), by V4's own rules. Each match is ovsx-lookalike:<kind>, HIGH, 10 points (the default weight; the scoring table has no row of its own for the Open VSX checks yet). A Marketplace extension's exact id published on Open VSX by someone Open VSX does not tie to the namespace is ovsx-lookalike:unclaimed, also HIGH: anyone may have taken the name. One exemption, found by measurement: Open VSX's vscode namespace holds VS Code's own built-in extensions, published by Open VSX itself, and a verified listing there is never read as a lookalike.
The first run on 1 November 2026 called a vscode namespace extension, a pack member of the PowerShell extension, a lookalike of the Marketplace's PowerShell extension; that is the exemption above. After it, O4 fired on none of the 100 most-downloaded extensions. The campaign listings this check was built from answer 404 today, so its clone rule is pinned by tests, not by a catch on a live listing.
Icons are not compared. A name that is not on the Marketplace's known list — a popular extension that lives only on Open VSX — has nothing to be compared with. A legitimate publisher whose Open VSX namespace is spelled differently from its Marketplace one reads as a lookalike until the alias is known.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '{namespace, name, displayName, verified}'Search the Marketplace for the display name. If an extension of that name exists there under another publisher, ask why this one is on Open VSX under a namespace you have not seen.
Would O4 have flagged the GlassWorm v2 clones? Its display-name and unclaimed-id rules are built from that shape, and the tests pin them on it. The listings themselves were removed before RepoGates read Open VSX, so this is not a measured catch; the campaign blocklist is what denies a re-published name.
Why is O4 not graded by age? Because the clone shape is the campaign. A day-old clone and a month-old clone are the same thing.
What is the vscode namespace exemption? Open VSX publishes VS Code's own built-in extensions under the vscode namespace. Their names are VS Code's own, so a verified listing there is not read as a copy.
V4 Lookalike publisher or name — the same comparison on the Marketplace · O1 Namespace ownership — who the unclaimed rule asks about · O9 Extension pack and dependencies — the same rule on the members a pack installs.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.