Check V4 · provenance family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: does this listing's publisher id, extension name or display name imitate one of the extensions people actually install? Three strings, compared against a reference list of the 200 most-installed extensions on the Marketplace, by three rules with two carve-outs.
A clone does not need to be clever. On 25 April 2026 Socket described 73 sleeper extensions on Open VSX linked to GlassWorm, six of them confirmed malicious at publication, and the technique was copying: each was published benign with the original's icon and description, under a publisher created at the start of April 2026 from a GitHub account with one or two public repositories, and updated later into what Socket called "a thin loader". Socket's example pair is the Microsoft Marketplace's own MS-CEINTL.vscode-language-pack-tr — around 1.1 million installs, domain-verified — against the Open VSX impersonation Emotionkyoseparate.turkish-language-pack. The display name and the icon are what a user reads; the id, which is the only thing a clone cannot copy, is what a user does not. Those clones were on Open VSX, which this roster does not assess; their shape is what V4's display-name rule is built from.
The publisher rule has its own precedent. In July 2025 Kaspersky described a fake "Solidity Language" extension on Open VSX and Cursor that outranked juanblanco.solidity by a newer update date and was tied to a $500K theft; it was removed on 2 July, and on 3 July a replacement appeared under the publisher juanbIanco — a capital I where the original has a lower-case l. That is one substitution, and one substitution is what the first rule looks for.
V4 fires vsx-lookalike:publisher, vsx-lookalike:name or vsx-lookalike:display, each at severity HIGH and costing 18 points. The reference list is backend/policy/vsx-known-publishers.json: the 200 most-installed extensions with their publisher ids and display names, generated by tools/vsx_known.py from the live gallery, regenerated weekly with the diff reviewed before it ships. Three rules:
And two carve-outs, both learned rather than designed. A known extension is the original and is never a lookalike of another; the rules do not run on it at all. And an extension name that two known publishers already share is generic, not a collision: python is both ms-python's and tht13's, so a third python under another publisher is not a name match. That carve-out exists because the flagship fired on itself in the first smoke test. A display name two listed extensions share is dropped from the list on the same reasoning — ambiguous by nature, never a collision. The evidence note:
"V4; one edit from a known publisher, or a known name/display name under another publisher — GlassWorm v2's 73 clones"
The verdict engine is the one behind all 17 Marketplace checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is separate — 100 minus every fired penalty, floored at zero, green at 80 and above, amber from 50 to 79, red below 50. One rule matching on an otherwise quiet listing scores 82, green, REVIEW: a warning, and on the preflight an ask before code --install-extension runs. A clone is rarely otherwise quiet — it is new (V2, 12) and from a publisher with no verified domain (V1, 15), and the three together are 55, amber. V4 feeds the Clone dimension with V1–V3, V5, V10 and V11. Its GitHub analogue is C4; its Hub analogue is H4.
V4 fired zero times in the 18 September 2026 measurement of the 100 most-installed extensions — and that is a test the check has to pass rather than a measurement result, because the 100 are all on the list the check compares against. A roster whose lookalike rule fires on the originals is broken, and it was, briefly: before the generic-name carve-out, ms-python.python matched tht13.python and the most-installed extension on the Marketplace was a lookalike of another Python extension. The cost as shipped lands on coincidence. A small publisher whose id happens to sit one character from a large one is REVIEW for as long as both exist, and so is a legitimate port that reuses a display name exactly — a theme republished for another editor under the same title as the original. The finding names the matched extension, so the reader can see in one line whether the resemblance is the point.
A name that resembles nothing on the list. The list is the 200 most-installed extensions, and a lookalike of anything outside it is invisible to V4. juanblanco.solidity has 1.8 million installs and is not among the 200, so on today's list juanbIanco — the example above — resembles nothing known; the rule describes it exactly and would not fire. The Turkish language pack in Socket's example pair is outside the 200 as well. A weekly regeneration widens the list only as far as the Marketplace's own install ranking does. Open VSX. The 73 GlassWorm v2 clones and the Turkish pair live there, and it is a different registry this roster does not assess. Invisible characters. The display-name rule compares the string as published: Checkmarx's juanblan281.solid281 (January 2026) carried the display name "solidity" with three zero-width characters inside it, which is not equal to "Solidity" and does not match. V14 reads agent rule files inside the package, not the display name, so it is not that check's input either; this page says so rather than implying otherwise. The icon. The clones copied the victims' icons, and no rule here reads an image.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
Without any tool: read the id, not the title. Every extension page on marketplace.visualstudio.com shows a "Unique Identifier" in its "More Info" panel, in the form publisher.name; compare it character by character with the one you meant to install, and open the publisher's page to see what else they ship. A clone has the right display name and the right icon and the wrong id, and usually nothing else under that publisher. Inside the editor the same id is visible from the command line:
code --list-extensionslists the ids of everything installed, which is the list to check against the ids you intended. The display name a clone copies never appears in that output.
What does one edit mean? A Levenshtein distance of one: a single character inserted, deleted or substituted, compared in lower case. ms-pyth0n is one substitution from ms-python; prettier-vscod is one deletion from prettier-vscode; juanbIanco, the capital-I publisher Kaspersky described replacing the fake Solidity extension on Open VSX in July 2025, is one substitution from juanblanco. The display-name rule is stricter — equality, not distance — because a clone copies the display name exactly.
Why is tht13.python not a lookalike of ms-python.python? Two carve-outs. A known extension — one of the 200 on the reference list — is the original and never a lookalike of another, and tht13.python is on the list. Separately, an extension name that two known publishers already share is generic rather than a collision: python is both ms-python's and tht13's, so a third python under another publisher is not a name match either. That second rule exists because the flagship fired on itself in the first smoke test.
Would V4 have caught the GlassWorm v2 clones? Those 73 clones were on Open VSX, which this roster does not assess, so the honest answer is that V4 was never in their path. The display-name rule is built from their shape — a listing that keeps the victim's display name and icon and changes only the id — and on the Microsoft Marketplace a display name equal to a top-200 extension's under a different id is HIGH, 18 points. The victims themselves have to be on the list: the Turkish language pack in Socket's example pair is outside the 200 most-installed today.
V1 Publisher verification — the check a clone also fails: a publisher created this month has no verified domain · C4 Fork and lookalike — the GitHub original, where the imitation is a repository name and the reference is the campaign's own victims · H4 Lookalike organisation — the same one-edit rule on Hugging Face namespaces.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of the 100 most-installed extensions on the Marketplace, and the reference list generated the same day from the 200 most-installed; Socket, 25 April 2026; Kaspersky Securelist, 10 July 2025; Checkmarx, 30 January 2026; weights from the product's scoring table.