Check V2 · provenance family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: how long has this listing existed on the Marketplace at the moment you are assessing it? Not the publisher, not the latest version — the listing, from its own publishedDate in the gallery record.
Every named campaign on the Microsoft Marketplace was a young listing when a victim met it, and most were removed before they were old enough to be anything else. Secure Annex's Ransomvibing extension, suspublisher18.susvsex, was uploaded on 5 November 2025 and, as Secure Annex recorded, Microsoft had removed it by 6 November. The three listings Datadog Security Labs attributed to MUT-9332 on 21 May 2025 each lived between one and five days — SmartContractAI.solaibot from 23 to 28 April, EthCompiler.among-eth from 10 to 11 May, JohnGaffney.blankebesxstnion from 11 to 12 May. Checkmarx's juanblan281.solid281 was published at 21:08 UTC on 8 January 2026, reported at 12:37 the next day, and taken down at 15:47 that afternoon. A listing that young is not evidence of anything by itself; it is the state in which every one of those payloads was actually delivered, and the state an attacker cannot avoid passing through.
There is a second reason age on the Marketplace deserves its own check. ReversingLabs' "Loophole" write-up of 28 August 2025 showed that a removed extension's name can be re-registered. To V2 a re-registered name is a new listing with a new publication date — not a continuation of the one that was taken down — which is the correct reading, and the reason V10 watches version churn on the same young listings.
V2 reads the listing's publishedDate and compares it with today. A listing under 30 days old (vsx_ext_age_high_days) fires vsx-ext-age at severity HIGH, costing 12 points — the identical weight of GitHub's C2 and the Hub's H1, and deliberately so. The scoring table's evidence note is the shortest on the roster:
"V2; mirrors repo-age"
The verdict engine is the one behind all 17 Marketplace checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is separate — 100 minus every fired penalty, floored at zero, green at 80 and above, amber from 50 to 79, red below 50. A young listing with nothing else fired scores 88, green, with a REVIEW verdict: a warning, and on the preflight an ask before code --install-extension runs. Stacked with the checks it is designed to stack with, the picture changes: young and from an unverified publisher (V1, 15 points) is 73, amber; add no declared source (V5, 12) and code that runs on activation (V7, 5 on a new listing from an unverified publisher) and the Ransomvibing shape settles at 56 — amber, REVIEW, on provenance alone. That last figure is an inference from the weights, because the listing itself is gone. V2 feeds the Clone dimension with V1, V3–V5, V10 and V11.
V2 fired zero times in the 18 September 2026 measurement of the 100 most-installed extensions. That is the expected result, not a finding: the most-installed listings are, by construction, old. The cost lands elsewhere — on every extension for its first month. There is no way to tell a three-week-old project from a three-week-old lure by the date, and the check does not try; it puts the number on the report so the other sixteen checks, and you, can weigh it. A developer's first extension, published last week from a publisher with a verified domain and a linked repository that passes the 22 GitHub checks, is REVIEW on this check alone for 30 days. That is the price of weighting the window every campaign passed through, and it is stated here rather than hidden. A young listing from a publisher whose other extensions are years old is where the age of the listing, and not the publisher, is what the report says.
The sleeper. GlassWorm v2's clones were published benign and updated weeks later, once they had been installed — Socket's account of 25 April 2026, on Open VSX, describes publishers created at the start of April whose listings were later updated so that, in Socket's words, "the extension itself acts as a thin loader". A listing that crossed 30 days before its malicious version arrived reads as established to V2, and the publication date has nothing left to say. Nor does age see a compromise of an old extension: 7finney.ethcode was an established extension when, as ReversingLabs described on 8 July 2025, a throwaway account's pull request added the dependency keythereum-utils and one require() to version 0.5.0; the extension passes the whole roster today with a score of 100, as it should. V2 reads the listing's date, never a version's — the re-publish cadence is V10, and what a version contains is the deep scan's question, not a timestamp's.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
Without any tool: the extension's page on marketplace.visualstudio.com carries a "More Info" panel with the listing's release and update dates. Read the release date, not the update date — an active extension updates constantly, and it is the first date that says how long the listing has existed. The gallery API returns the same three fields; it is the endpoint VS Code itself uses, a POST with no token:
curl -s -X POST https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery \
-H 'Accept: application/json;api-version=3.0-preview.1' \
-H 'Content-Type: application/json' \
-d '{"filters":[{"criteria":[{"filterType":7,"value":"PUBLISHER.EXTENSION"}]}],"flags":914}' \
| jq '.results[0].extensions[0] | {publishedDate, lastUpdated, releaseDate}'Then put publishedDate beside the publisher's other listings and the install count. Published this week, on a publisher with no other extensions, with five figures of installs already, is the shape V3 exists to name.
Is a new extension a risk? Every extension is new for its first thirty days, so on its own the answer is no — which is why V2 costs 12 points and warns rather than anything stronger. It matters in combination: a listing days old, from a publisher with no verified domain, declaring no source and running code on activation, is the Ransomvibing shape of November 2025, and on the shipped weights that combination is amber and REVIEW on provenance alone.
Why 30 days and 12 points? Because V2 is the Marketplace mirror of GitHub's C2 and the Hub's H1, and it carries their weight exactly — the evidence note reads, in full, "mirrors repo-age". The named Marketplace campaigns lived far inside that window: Ransomvibing was uploaded on 5 November 2025 and removed by the 6th; the Checkmarx-reported solid281 was published on 8 January 2026 and taken down the next afternoon; the three MUT-9332 listings Datadog described each lasted one to five days.
What about an extension that turned malicious after it was old? V2 has nothing to say about it, and says so. GlassWorm v2's sleeper clones were published benign and updated weeks later — Socket, 25 April 2026, on Open VSX — and 7finney.ethcode was an established extension when a pull request added a malicious dependency to version 0.5.0 in 2025. A publication date reads the listing, not the update; the re-publish cadence is V10's job and the bundle is the deep scan's.
V1 Publisher verification — the check that makes a young listing matter: new and unverified is 27 points, new alone is 12 · V10 Pre-release and re-publish cadence — what V2 hands off to: five versions in seven days on the same young listing · C2 Repository age — the GitHub original, same 12 points, same reasoning · H1 Repository age — the Hugging Face mirror, and the third platform on which age alone never moves a verdict past a warning.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of the 100 most-installed extensions on the Marketplace; Secure Annex, 5 November 2025; Datadog Security Labs, 21 May 2025; Checkmarx, 30 January 2026; ReversingLabs, 28 August 2025 and 8 July 2025; Socket, 25 April 2026; weights from the product's scoring table.