Check O7 · execution surface family · severity MEDIUM · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 OWASP LLM06 ATLAS AML.T0050 ATLAS AML.T0011 The manifest declares that the extension runs code when the editor activates it.
The question this check asks: does the extension's manifest name a main or browser entry point — code the editor runs — or is it a theme, a grammar or a snippet pack that ships none?
An extension that runs code runs it with the user's permissions, inside the editor, on every workspace it opens. A theme that suddenly needs an entry point is worth a look; a language server that declares one is ordinary. O7 says which kind of thing is being installed, so the other checks can be read in that light.
O7 reads package.json from the package (manifests up to 4 MB). An extension that runs code is ovsx-executes-code: MEDIUM and 4 points on a listing under 90 days old from an unverified namespace, a note everywhere else (the default weight; the scoring table has no row of its own for the Open VSX checks yet). When the manifest cannot be read, O7 is listed as not checked.
94 of the 100 most-downloaded extensions measured on 1 November 2026 run code. 93 are notes; one is the medium finding on the measurement's single REVIEW, a 30-day listing from an unverified namespace.
What the code does. The code bundle is not read on this tier. Code that a theme ships anyway: a package can carry files it does not declare; O12 lists the executables and native code in it.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -sL "$(curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq -r .files.manifest)" | jq '{main, browser}'No main and no browser entry means the editor runs no code from this extension.
Is an extension that runs code a problem? No. Most useful extensions do. O7 is a note unless the listing is also new and from an unverified namespace.
Is the code read? No. The code bundle is not read on this tier; O7 reads only whether the manifest declares an entry point.
Why read package.json and not the record? Open VSX's record does not say whether an extension runs code; the manifest does.
V7 Declares code execution — the Marketplace twin · O12 Package contents — what the package ships besides · O8 Proposed API access — what that code asks the editor for.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.