Extension Advisor

Extension Advisor checks an IDE extension's security score before anyone installs it. Enter the exact extension ID and the marketplace it comes from.

The IDE Extensions page tells you about the extensions already running across your fleet. Extension Advisor answers the question that comes earlier: a developer wants to install something, or has just been sent a link to something, and you want a view on it before it lands on a machine. The lookup works for any extension, including ones nobody in your organization has installed yet.

Checking an extension

• Enter the Extension ID. This is the exact published identifier, not the display name shown in the marketplace.
• Choose the Marketplace the extension is published to. Four are supported: VS Code Marketplace, Open VSX, JetBrains Marketplace, and Visual Studio Marketplace.
• Select Check score.

The marketplace has to match where the extension is actually published. An id that is correct for one marketplace will not resolve against another.

Extension ID formats

Marketplace family	Format	Example
VS Code, Open VSX, Visual Studio	publisher.extension-name	ms-python.python
JetBrains	Reverse domain style	com.example.plugin

The identifier has to be exact. Two extensions can carry near-identical display names while differing only in publisher, which is precisely the situation a typosquat creates, so a lookup by display name would defeat the purpose of the check.

The quickest way to get an exact id is the marketplace listing itself: it appears in the listing's URL and in the installation command the marketplace offers.

If the id cannot be found in the selected marketplace, Extension Advisor reports Extension not found. Check the id character for character, then check the marketplace selection, since a valid id looked up against the wrong marketplace produces the same result.

Understanding the result

The result opens with the extension's identity, so you can confirm you looked up what you meant to: its display name and description, the id, the marketplace, the publisher with a badge where the publisher is verified, the install count, and a Marketplace link out to the listing.

Beneath that, Check whether this extension is already installed takes you to IDE Extensions filtered to this id, so you can see whether it is running in your fleet already and on how many devices. An extension you are evaluating for one team is often already installed by another.

Security Score

The Security Score is given out of 10 and rendered as a colour-coded bar. It summarises the supply chain signals below it, and it is the same score shown against installed extensions on the IDE Extensions page.

The signal breakdown

The IDE extension security score table shows each signal that contributed, with a marker for whether it passed, warrants attention, or failed:

Signal	What it reports
Install Count	How many users the extension has. A large install base is not proof of safety, but a near-empty one on an extension presented as popular is a warning.
Latest Release Date	When it was last updated. Long gaps suggest an abandoned extension, which is both unpatched and an attractive target for a takeover.
Verified Publisher	Whether the marketplace has verified the publisher.
License	Whether a license file was detected.
Vulnerabilities	Known vulnerabilities detected in the extension.
Branch Protection	Whether the source repository protects its development and release branches. Weak branch protection is how a compromised maintainer account turns into a compromised release.
Security Policy	Whether the repository publishes a security policy, which is the route for reporting a vulnerability responsibly.

Read the breakdown rather than the number alone. A widely used extension from a verified publisher can still carry open vulnerabilities, and the table is what tells you which part of the score is weak. The score is a summary of evidence, not a verdict on whether to install.

When to use it

• A developer asks to install an extension. Check it before approving, rather than discovering it on the IDE Extensions page afterwards.
• An extension has been recommended in a chat, an issue, or a blog post. These are the installs that skip review entirely.
• You are choosing a replacement. After an extension is compromised or abandoned, the alternatives are usually a shortlist of similar extensions, and this scores them without installing any.
• A name looks almost right. If an id differs from the one you expected by a character or a publisher, check both.