Check V6 · execution family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: does the latest version of this extension carry the signature the Marketplace attaches to every package it publishes? Not whether the code inside is benign — whether the package went through the Marketplace's publish path at all.
The Marketplace signs every .vsix it publishes, and VS Code verifies that signature when it installs the extension. The signature travels as its own asset on the version — Microsoft.VisualStudio.Services.VsixSignature, listed beside the package and the manifest in the gallery record. Its presence establishes one specific thing: the bytes VS Code installs are the bytes the Marketplace published for that version. Its absence means the latest version has not been through that path. In practice that is usually an extension abandoned before signing began — a listing whose last upload predates it — rather than an attack. But "the platform's own attestation is missing" is not something to read past on the way to an install, and it is a fact the listing page does not show you.
V6 is one of the two checks on what the Marketplace itself attests about a package — the signature here, the validation flag in V11. Both are necessary and neither is sufficient: they say the platform's process ran, not what the extension does. The checks on what the extension declares and carries — V7, V8, V9 and V12 — sit beside them in the one dimension V6 belongs to, install and run (V6, V7, V8, V9, V11, V12); the other three dimensions do not draw on it at all.
V6 reads the asset list of the listing's latest version from the gallery's extensionquery endpoint — the one VS Code itself calls, no token, no rate-limit headers — and fires vsx-unsigned when the signature asset is not among them. The finding is HIGH, costing 14 points. The scoring table's evidence note, verbatim:
"V6; the Marketplace signs every package it publishes — an unsigned latest version has not been through that"
The verdict engine behind all 17 checks separates the verdict from the score. Any CRITICAL finding is BLOCK; any HIGH or MEDIUM finding is REVIEW; INFO only is PASS. The score is 100 minus every fired penalty, floored at zero — 80 and above green, 50 to 79 amber, under 50 red. A lone V6 finding is therefore a REVIEW at 86: the score is still green, the verdict is not, and it is the verdict that the preflight and the MCP tools act on — the profile's warn, never a refusal. V6 has no CRITICAL tier, so on its own it never moves an extension to BLOCK. The same test runs again inside V9, on every pack member and declared dependency the gallery returns: "unsigned" is one of the four reasons a member is graded weak.
V6 fired zero times in the 18 September 2026 measurement of the 100 most-installed extensions on the Marketplace, run locally through the same code as /v1/vsx/score. That run came out 99 PASS, 1 REVIEW, 0 BLOCK, with every listing read; the one REVIEW was V5 on abusaidm.html-snippets, not this check. Zero is the expected result on that cohort: the 100 most-installed are maintained, and every recent upload has been signed. Where V6 would fire is on a long-abandoned listing that still installs and still works — a useful extension whose last version predates signing. That is a REVIEW and a warn, not a refusal, on exactly the listing to look at twice before installing, because nobody is looking after it.
A signature proves the package is what the Marketplace published; it proves nothing about intent. Every Microsoft-Marketplace campaign exemplar in the write-ups RepoGates verified on 18 September 2026 — ReversingLabs' 19 theme extensions with a trojan in a fake PNG (10 December 2025), the two MaliciousCorgi AI extensions Koi Security reported (January 2026, as quoted by BleepingComputer and The Hacker News), Secure Annex's suspublisher18.susvsex (5 November 2025) — was published through the Marketplace and signed like any other package. V6 would have said nothing about any of them. The Marketplace signs whatever the publisher uploaded.
V6 also reads that the signature asset exists; it does not verify the signature itself — VS Code does that at install. It looks at the latest version only, so a pinned older version is not assessed. And a listing Microsoft has removed — as all 40 named exemplars had been by 18 September 2026 — returns no gallery record: "not assessable", a MEDIUM finding with the warn action, never a pass. RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
The listing page on the Marketplace does not show whether a version is signed; the gallery does. POST to https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery — the endpoint VS Code itself uses — with the extension's id and the query flag that includes files, and read the latest version's files array: each entry names its assetType, and the one this check looks for is Microsoft.VisualStudio.Services.VsixSignature, beside Microsoft.VisualStudio.Services.VSIXPackage and Microsoft.VisualStudio.Code.Manifest. If it is missing, look at the listing's last-updated date — a version that predates signing is an abandoned listing — and at the validated flag on the same record, the platform's other gate.
Does a signed package mean the extension is trustworthy? No. The signature proves that the bytes VS Code installs are the bytes the Marketplace published for that version — nothing about what those bytes do. Every Microsoft-Marketplace campaign exemplar in the write-ups RepoGates verified on 18 September 2026 was published through the Marketplace and signed like any other package. V6 is one of two checks on what the platform attests (V11 is the other); the checks on what the extension declares and carries are V7, V8, V9 and V12.
Why is a missing signature HIGH when it fired zero times on the top 100? Because an unsigned latest version has not been through the path every current Marketplace upload takes, and the most common reason is a listing abandoned before signing began — which is also a listing nobody is maintaining. The 100 most-installed extensions are actively maintained by construction, so zero is the expected result there. The cost when it does fire is a REVIEW verdict with a score of 86 and the profile's warn action, not a refusal; V6 has no CRITICAL tier and on its own never moves an extension to BLOCK.
Does V6 cover an extension installed into VSCodium, Cursor or Windsurf? No. Those editors install from Open VSX, a different registry with its own listings and its own signing arrangements, and this roster does not assess it. V6 reads the Microsoft Marketplace gallery record for the key vsx/{publisher}/{extension} and nothing else.
V11 Marketplace validation — the sibling attestation: the platform's automated lint on the same record, passed by every named campaign just as the signature was · V12 Package contents — what is actually inside the signed package, read from the central directory without downloading it · V9 Extension pack and dependencies — applies this signature test to every member an install pulls in alongside · H6 Hub malware-scan hit — the Hugging Face Hub's own attestation in the same role: what the platform says about an artefact, which is never the same as what the artefact does.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of the 100 most-installed extensions on the VS Code Marketplace, run locally through the same code as /v1/vsx/score; campaign facts as published by ReversingLabs and Secure Annex and, for Koi Security's research, as quoted by BleepingComputer and The Hacker News; weights from the product's scoring table.