Check V10 · provenance family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: how is this extension being published — is the version you would install a pre-release, and on a listing only days old, how many distinct versions have already gone up in the past week?
V10 reads two facts about an extension's publishing rhythm, and they mean very different things. The first is ordinary. VS Code has a first-class pre-release channel: a publisher ships a pre-release version beside the stable one, the Marketplace marks it with the Microsoft.VisualStudio.Code.PreRelease property, and a user has to opt in to receive it. In the 18 September 2026 measurement of the 100 most-installed extensions, 31 had a pre-release as their latest version — ms-python among them. That is a fact about how the extension is developed, not about who is behind it, and RepoGates lists it as a note.
The second is the cadence. A listing that did not exist a month ago and has already been republished five times in the past seven days is what a takedown-and-re-upload loop looks like from the outside. The Marketplace removes listings reactively, after a report, and the loop runs in hours: Checkmarx's juanblan281.solid281 was published on 8 January 2026 at 21:08 UTC, reported the next day at 12:37 and taken down at 15:47. A publisher who expects that turnaround publishes in volume. ReversingLabs' post of 28 August 2025 (Lucija Valentić) on three related early-stage ransomware listings — ahban.shiba and ahban.cychelloworld, published October 2024, last updated early March 2025 and removed; then ahbanC.shiba, published 24 March 2025 and unpublished 17 June 2025 — reported that a removed extension's name can be re-registered. Every one of those names answers "not assessable" today. The shape that outlives any single takedown is the rhythm, and the churn row is drawn around it.
The pre-release half reads the gallery record: when the latest version carries Microsoft.VisualStudio.Code.PreRelease set to true, vsx-prerelease fires at INFO, costing 0 points. The scoring table's evidence note is one word long:
"V10; informational"
The churn half runs only when the listing's publishedDate is under 30 days ago — the same threshold V2 uses — and only then is the version history fetched, in one extra gallery query. RepoGates counts the distinct versions whose lastUpdated falls inside the past 7 days; at 5 or more, vsx-churn fires at MEDIUM, costing 6 points:
"V10; five versions in seven days on a listing under 30 days — the takedown-and-re-upload cadence"
The history is fetched only for a young listing on purpose. A mature extension's version history runs to megabytes — ms-python's is 6.5 MB — and churn has a meaning only in the first month, so an established extension's cadence is simply not read; if the history cannot be fetched for a young listing, the scan is noted as partial and retried on a short TTL rather than cached as a PASS. The verdict rule is the same across all 17 checks: the verdict follows the worst fired severity — any CRITICAL reads BLOCK, any HIGH or MEDIUM reads REVIEW, INFO alone reads PASS — and the score, 100 minus every fired penalty and floored at zero, is reported beside it, green at 80 and above, amber from 50 to 79, red below 50. A lone churn finding therefore reads REVIEW at a score of 94; a lone pre-release note reads PASS at 100. V10 feeds the Clone the source dimension alongside V1–V5 and V11 — the seven checks that ask whose work you would be pulling — which takes the worst of its checks and reads PASS only when every one of them ran.
The pre-release note fired on 31 of the 100 most-installed extensions in the 18 September 2026 measurement and moved none of them: it is a note by design, because the flagship's own latest version is one. Churn fired zero times, and the measurement says nothing about its false-positive rate — none of the 100 is under 30 days old, so no version history was fetched for any of them. The cost this row does carry is easy to describe: a genuinely new extension whose author ships five patch releases in its first week — a plausible launch week — reads REVIEW at 94 for as long as the window holds. That is why the row is MEDIUM at 6 points rather than HIGH: it asks for a look, and a look at a week-old listing's version list takes a minute.
A rhythm says nothing about what is being published. One version is enough for a payload: ReversingLabs' 19 fake-image theme extensions (10 December 2025) were every one at version 1.0.0, spread across four publishers and nineteen names rather than across versions, and V10 would have had nothing to say about any of them. The opposite cadence is invisible too: Socket's GlassWorm v2 sleepers (25 April 2026, on Open VSX) were published benign and updated weeks later, which is a slow rhythm, not churn. An established extension's history is never read — 7finney.ethcode had version 0.5.0 compromised through a pull request (ReversingLabs, 8 July 2025), was removed by 26 June 2025 and shipped a corrected 0.5.1 on 1 July 2025, all on a listing old enough that V10 never fetched its history; it reads PASS at 100 today, as a control should. And a re-registered name is a new listing to this check: RepoGates cannot tie it to the one that was removed, which answers "not assessable" — as all 40 named Microsoft-Marketplace exemplars did on 18 September 2026.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
Without installing anything: open the listing on marketplace.visualstudio.com. A pre-release shows as a badge on the listing, and VS Code installs it only when you ask — code --install-extension publisher.extension --pre-release. The Version History tab lists every published version with its date: read the first entry's date against the listing's own publication date, and on a listing weeks old, count how many entries fall in the past seven days. Five in a week on a listing under a month old is the shape this check names; five in a week on an extension that has been there for years is a busy maintainer.
Is a pre-release extension risky? Not on its own. VS Code has a first-class pre-release channel that users opt into, and 31 of the 100 most-installed extensions had a pre-release as their latest version in the 18 September 2026 measurement — ms-python among them. RepoGates lists it as a note worth 0 points; it moves no verdict.
Why is the version history only read for a listing under 30 days old? Because churn is a property of a listing that has not yet earned its age, and because a mature extension's version history runs to megabytes — ms-python's is 6.5 MB — for a question that only has a meaning in the first month. The history is fetched in one extra gallery query when the listing is under 30 days old and not otherwise, so an established extension's cadence is never read here. That is a stated limit, not an oversight.
Does a removed extension that comes back under the same name look new? Yes. ReversingLabs reported on 28 August 2025 that a removed extension's name can be claimed again, and a re-registered listing carries a fresh publication date: V2 reads it as under 30 days old, which is exactly when V10 fetches its history and counts versions. What RepoGates cannot do is tie the new listing to the removed one — the removed one answers "not assessable", as all 40 named Microsoft-Marketplace exemplars did on 18 September 2026.
V2 Extension age — the 30-day threshold V10 shares, and the age that decides whether the version history is read at all · V11 Marketplace validation — the other Marketplace-side state on the clone dimension, retried on a short TTL rather than settled · C7 Maintenance activity — the GitHub roster's reading of a repository's rhythm, from commits rather than Marketplace versions.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of the 100 most-installed extensions (99 PASS, 1 REVIEW, 0 BLOCK; the pre-release note on 31, churn on 0) and the same day's catch-rate probe (40 named Microsoft-Marketplace exemplars, all removed); ReversingLabs' posts of 28 August 2025, 8 July 2025 and 10 December 2025, Checkmarx's of 30 January 2026 and Socket's of 25 April 2026, as published; weights from the product's scoring table.