Check V5 · provenance family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: where does this extension say its code comes from — and what does that repository look like through the 22 GitHub checks? It is the one check on the Marketplace roster that composes with another roster: the declared source is assessed on the same pass, and its verdict rides along.
A .vsix is a build product. Its JavaScript is bundled and often minified, and this tier does not read it; the repository the listing declares is the only place the extension's provenance can be read at all — who made it, when, whether anyone else has, what it carries. A listing that declares no source, from a publisher with no verified domain, is a package nothing can be verified against, and that is the state Secure Annex's Ransomvibing extension of 5 November 2025 shipped in: suspublisher18.susvsex, a publisher created that day, no domain, no repository, code that runs on activation. On the shipped weights that is V1, V2, V5 and V7 together on a listing hours old — REVIEW on provenance alone, an inference from the weights because the listing is gone.
When a source is declared, the interesting question is not whether it exists but what it is. RepoGates already has 22 checks that answer that for a GitHub repository, from the owner's account age to the campaign list; V5 exists so an extension is not assessed in ignorance of what those 22 would say about the code it claims to be built from.
V5 reads the declared source in order of authority — the gallery's Links.Source property, then Links.GitHub, then the manifest's repository field — and produces one of four findings.
No source. vsx-no-source is graded by the listing's age and the publisher's domain: HIGH, 12 points, on a listing under 90 days (vsx_established_days); MEDIUM, 6 points, on an established listing whose publisher has no verified domain; INFO — a note, no points — for a domain-verified publisher's closed-source listing. The evidence note:
"V5; nothing to verify the package against: HIGH under 90 days, MED for an established listing without a verified domain, a note for a domain-verified publisher's closed-source listing (Copilot, Claude Code, ChatGPT — 3 of the top-100, measured 2026-09-18)"
Owner mismatch. When the source is on GitHub but under an owner that is neither the publisher id nor one of its known aliases, vsx-source-owner-mismatch is HIGH, 10 points, on a new listing and a note on an established one. The alias table is generated with the reference list from the 200 most-installed extensions: prettier's publisher is esbenp and its source is github.com/prettier; Material Icon Theme's publisher is PKief and its source is under material-extensions. Neither is a mismatch.
"V5; source under another GitHub owner — ordinary for an established extension (prettier lives at github.com/prettier), a signal on a new one"
The source's own verdict. A GitHub source is assessed through the 22 checks on the same pass and returned in the response's source object — its verdict, score and the findings that drove it. The finding vsx-source:owner/repo carries that verdict into the extension's report: CRITICAL, 45 points and a BLOCK verdict when the source is campaign-listed; HIGH, 15 points, when the source's own verdict is BLOCK; a note otherwise, including when the source is REVIEW.
"V5; the declared source repository's own 22-check verdict rides along: CRIT when it is campaign-listed, HIGH when it is BLOCK, a note otherwise"
A source outside GitHub. vsx-source-external:host is a note. GitLab and every other host are not assessed on this tier.
"V5; a non-GitHub source is not assessed on this tier"
The verdict engine is the one behind all 17 Marketplace checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is separate — 100 minus every fired penalty, floored at zero, green at 80 and above, amber from 50 to 79, red below 50. A campaign-listed source is the single CRITICAL on the whole roster: the extension is BLOCK everywhere, in every dimension. V5 feeds the Clone dimension with V1–V4, V10 and V11.
In the 18 September 2026 measurement of the 100 most-installed extensions V5 produced a note on 99 of the 100 — 95 source verdicts riding along, 3 closed-source listings from domain-verified publishers, 1 source outside GitHub — and one MEDIUM: abusaidm.html-snippets, established, no verified domain, no source, the run's only REVIEW. Two facts in that result shaped the grading. First, 88 of the 95 linked sources are REVIEW on the 22, almost all for the same reason: a VS Code extension's repository ships .vscode/ launch and task configuration by nature, and C13 warns on it because that configuration runs when the folder is opened in an editor. That is a fact about extension development, not a finding about the extension, so a REVIEW source is a note and only a BLOCK source or a campaign listing escalates. Second, before the closed-source grading, all four sourceless listings in the run were REVIEW, Copilot among them; the measurement went from 87 PASS to 99 once that and two other gradings landed, and the one that remains is the case the grading was written to keep.
Whether the package was built from the source. A listing can declare any repository it likes, and this tier never diffs the .vsix against it; a declared source proves that a repository exists and what the 22 checks say about it, not that the bundle came from it. A payload fetched at runtime. GlassWorm v2's loaders, in Socket's April 2026 account, retrieved a .vsix from a GitHub release and installed it with --install-extension; that release is not a declared source and V5 does not see it. A change inside the source. The 22 checks read a repository's provenance and its file tree, not a diff: when a throwaway account's pull request added the dependency keythereum-utils to 7finney.ethcode 0.5.0 — ReversingLabs, 8 July 2025 — the source was the attack path and its provenance did not change; the extension passes the roster today with a score of 100. Any host but GitHub. A GitLab source is a note and nothing more.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
Without any tool: the extension's page on marketplace.visualstudio.com lists a "Repository" link in its "Resources" panel when one is declared, and nothing when it is not. Compare the GitHub owner in that link with the publisher id in "Unique Identifier": the same, an obvious organisation-for-person pairing, or something else. Then read the repository the way the 22 checks do — the three fields worth reading together:
gh api repos/OWNER/REPO --jq '{created_at, pushed_at, stargazers_count}'Compare created_at with the listing's own release date and the owner's Joined date. A repository created the same week as the publisher and the listing is the shape V5's HIGH exists to name; a repository years older than the listing, under an organisation the publisher plainly belongs to, is the ordinary case and the report says so in one line. RepoGates' own verdict for that owner/repo is what the extension's source object contains.
Why is a closed-source extension only a note? Because the biggest ones are closed by design. GitHub Copilot, Claude Code and ChatGPT — 3 of the 100 most-installed — declare no repository, and all three come from domain-verified publishers. So no source is a note on an established listing from a domain-verified publisher, MEDIUM at 6 points when the publisher has no verified domain either, and HIGH at 12 only on a listing under 90 days old, where nothing at all ties the package to anyone. The one REVIEW in the 18 September 2026 measurement, abusaidm.html-snippets, is the middle case: established, unverified, sourceless.
Why do so many source repositories come back REVIEW on the 22? 88 of the 95 GitHub sources linked from the 100 most-installed extensions are REVIEW on the GitHub roster, and almost all for one reason: a VS Code extension's repository carries .vscode/ launch and task configuration by nature, and C13 warns on editor and workspace config that runs when the folder is opened. That is a fact about extension development, not about the extension, so V5 passes a source's REVIEW through as a note and escalates only when the source's verdict is BLOCK or the source is campaign-listed.
Does a declared source prove the package was built from it? No. The .vsix is a build product and this tier never diffs it against the repository; a listing can point at any repository it likes. What V5 establishes is that the repository the extension names has been through the 22 checks and what they said. It does not see a payload fetched at runtime — GlassWorm v2's loaders retrieved their .vsix from a GitHub release, which is not a declared source — and it does not see a change inside the source, such as the pull request that compromised 7finney.ethcode 0.5.0 in 2025.
V1 Publisher verification — the other thing a sourceless listing usually lacks, and the field that decides MEDIUM against a note · V4 Lookalike publisher or name — a clone's declared source, when it has one, is where the mismatch shows · C1 Owner account age — the first of the 22 the declared source is put through, and the one that turns a source into a BLOCK · C13 Editor and workspace config — why 88 of 95 extension sources are REVIEW on the 22, and why that is a note here.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of the 100 most-installed extensions on the Marketplace, and the alias table generated the same day from the 200 most-installed; Secure Annex, 5 November 2025; Socket, 25 April 2026; ReversingLabs, 8 July 2025; weights from the product's scoring table.