Check O5 · provenance family · severity CRITICAL · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 ATLAS AML.T0010 Where the published artefact came from. A declared source that is campaign-listed or BLOCK is the compromise ATLAS names; no declared source at all is an evidence gap, which is why the check says which it found.
The question this check asks: does the extension name a source repository, does that repository belong to the namespace that published it, and what does RepoGates say about the repository itself?
A declared repository is the one thing a reader can check a package against. A listing with none asks to be taken on trust; a listing that points at someone else's repository borrows that project's history. And a repository RepoGates would block on its own should not become acceptable by being packaged as an extension.
O5 reads the record's repository. A GitHub or gitlab.com repository is assessed through the 22 checks on the same pass, and its verdict rides along as ovsx-source:<repository>: when the repository is BLOCK or on the campaign blocklist the row is CRITICAL, 25 points, and the extension is BLOCK, carrying the repository's own findings so the action is the one a clone of that repository gets under the same profile; any other verdict is a note. No repository at all is ovsx-no-source: HIGH and 10 points on a listing under 90 days old, MEDIUM and 4 points on an established listing from an unverified namespace, a note from a verified one. A repository on another host is a note, not assessed. A repository whose owner is not the namespace is ovsx-source-owner-mismatch, HIGH on a new listing and a note on an established one, unless the publishing user's GitHub login owns it. These are the default weights; the scoring table has no row of its own for the Open VSX checks yet.
Of the 100 most-downloaded extensions measured on 1 November 2026, 95 declare a repository: 93 of those repositories are REVIEW through the 22 (dev containers and editor settings, mostly), two PASS, none BLOCK, so the critical row never fired. Five declare none, all notes. Sixteen name a repository under another owner, all notes on established listings. The first run found one false mismatch: a namespace spelled in lower case, published by the GitHub account that owns the repository under a longer name. Open VSX signs publishers in through GitHub, so that login now ties the two.
Whether the package was built from that repository. The repository is a claim; nothing compares the package with the source. A REVIEW repository is a note here, by the same rule as S1 and P2: the extension is judged on what it is, and the repository's REVIEW is shown beside it.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '{repository, namespace, publishedBy: .publishedBy.loginName}'Open the repository, compare its owner with the namespace and the publishing login, and look at its own RepoGates verdict.
Why is a BLOCK repository a BLOCK extension? Because the extension is a packaging of that repository. Packaging it does not make it acceptable, so the extension carries the repository's findings and gets the action a clone of it would get.
Is an extension with no repository blocked? No. It is a high finding on a listing under 90 days old, a medium one on an established listing from an unverified namespace, and a note from a verified one.
Does O5 check that the package matches the repository? No. The repository is a claim the publisher makes; nothing on this tier compares the package with the source.
V5 Source repository — the Marketplace twin · S1 Source repository — the rule a BLOCK source follows everywhere · C1 Owner account age — the check behind most repository BLOCKs.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.