Check O9 · execution surface family · severity HIGH · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 ATLAS AML.T0010 An extension pack or dependency installs other extensions: one install decision, several publishers — and GlassWorm's March 2026 wave was delivered that way.
The question this check asks: which other extensions does installing this one bring with it — its dependencies and bundledExtensions — and does any of them fall short?
A pack is only as trustworthy as its weakest member. On 13 March 2026 Socket described at least 72 malicious Open VSX extensions in the GlassWorm v2 campaign delivered exactly this way, through extension packs and dependencies, and wrote that “As of March 13, Open VSX has removed the majority”. A member installed alongside is code the user never chose by name.
O9 reads the record of each member, eight at most. A member from an unverified namespace, with a review status other than published, or with a lookalike name is ovsx-pack-weak:<member>, HIGH, 10 points. A member Open VSX does not serve is ovsx-pack-missing:<member>: HIGH when its namespace has no owner, because the name is then anyone's to publish under, and a note when the namespace has an owner, because only that owner can publish it. Every other member is a note. These are the default weights; the scoring table has no row of its own for the Open VSX checks yet.
19 of the 100 most-downloaded extensions measured on 1 November 2026 install others alongside, 31 members in all, every one a note. Two members are not on Open VSX, both in namespaces that have an owner. That rule came from the first smoke run: a popular Python extension lists a Microsoft language server that is not on Open VSX by licence, and only Microsoft can publish into that namespace.
Members past the eighth. A member's own pack: one level is read. A member's code: not read on this tier.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '{dependencies, bundledExtensions}'Look up each member's own record the same way, and check that its namespace is verified.
Would O9 have flagged the March 2026 GlassWorm packs? Its weak-member rule is built from that shape, but those extensions were removed before RepoGates read Open VSX, so this is not a measured catch.
Why is a missing member a note in some namespaces? Only a namespace's members can publish into it. If the namespace has an owner, nobody else can take the missing name; if it has none, anyone can.
How many members are read? Eight. A pack with more is read in part, and the rest are not assessed.
V9 Extension pack and dependencies — the Marketplace twin · O1 Namespace ownership — the rule applied to each member · O4 Lookalike of a Marketplace extension — the name rule applied to each member.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.