Check O12 · execution surface family · severity MEDIUM · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 ATLAS AML.T0011 ATLAS AML.T0074 Executables inside the .vsix. GlassWorm v2's sleepers became loaders as platform-specific native binaries, which is why the check reads the listing and says what a file list cannot tell from a dependency.
The question this check asks: what does the package ship besides its JavaScript — executables and scripts inside its dependency folders, native code anywhere — and how large is it?
GlassWorm v2's sleepers became loaders as platform-specific native binaries (Socket, 25 April 2026), and the 2025 campaign on the Marketplace hid its code inside a dependency folder. A file list cannot tell a dependency's helper script from a planted one, but it can say what is there.
O12 reads the package's central directory: the file list at the end of the .vsix. Open VSX's file host refuses a range counted from the end, so the size comes from the record and the list is read by explicit ranges; the package is never downloaded. An executable or script (.exe .dll .sh .ps1 .bat .cmd .jar …) inside node_modules/ is ovsx-dep-executable, native code (.node .so .dylib .dll .exe) anywhere is ovsx-native-binary: each a note on an established listing and MEDIUM, 4 points, on one under 90 days old, three of each shown (the default weight; the scoring table has no row of its own for the Open VSX checks yet). A package over 25 MB is a note. When the list cannot be read, O12 to O16 are listed as not checked.
On 1 November 2026, 24 of the 100 most-downloaded extensions carry an O12 note: native code in 10, executables in dependency folders in 7, a package over 25 MB in 14. All are established, so none is a finding. Language servers and debuggers ship native code by design.
What the files contain. The code bundle is not read on this tier; a deep scan of an Open VSX package is not offered yet. JavaScript hidden in a dependency looks like any other dependency on a file list.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -sL -o x.vsix "$(curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq -r .files.download)" && unzip -l x.vsixThat downloads the package to your machine; RepoGates reads only its file list.
Is native code a red flag? Not on an established listing: language servers and debuggers ship it. On a listing under 90 days old it is a medium finding.
Does RepoGates download the package? No. It reads the file list at the end of the package by byte ranges.
Is the code read? No. A file list says what is there, not what it does.
V12 Package contents — the Marketplace twin · O7 Declares code execution — what the manifest says runs · O13 Agent config files — the files read out of the same list.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.