UBEL — Supply-Chain & Secrets Scanner for VS Code

Multi-ecosystem dependency and secrets scanner for the developer's machine and tools.
Covers source repos, developer machines, and exposed secrets — zero cloud calls except for osv.dev and NVD API (both mirror-configurable).

What is UBEL?

UBEL is a software composition analysis (SCA) tool, secrets detector, and install-blocking firewall built for teams who care about what enters their supply chain at every layer. Unlike report-only scanners, the full UBEL toolset enforces policy — if a scan fails, it blocks the operation and tells you exactly why.

As a project, UBEL spans the entire delivery chain: from the moment a developer adds a dependency, through CI validation, to what is running on a deployment server or inside an AI agent's runtime environment.

This specific extension covers the editor-side slice of that: dependency vulnerability scanning (SCA), secrets detection, and host/editor-extension auditing, all in health (report-only) mode. It does not include the install-time firewall (the scan-before-you-install gate that blocks a malicious package before it ever reaches node_modules), AI-powered SAST/malicious-code scanning, or CI/CD wiring — those live in the @arcane-spark/ubel-node CLI package (npm, docs) and the official GitHub Action, which this extension is a companion to rather than a replacement for.

Extension's features

• Full dependency resolution with PURL generation
• Querying authoritative vulnerability sources in real time, allowing newly published advisories to be detected immediately without waiting for scheduled database refreshes unlike the competitors.
• Vulnerability scanning via batched API queries to OSV.dev and NVD's APIs
• Concurrent vulnerability enrichment (CVSS, fix recommendations, references)
• Policy engine — block/allow by severity threshold and unknown-severity packages
• Malicious package (infection) detection — always blocked regardless of policy
• Secrets detection — Trivy's ported, Apache-2.0-attributed ruleset, extended with UBEL's own rules for vendors Trivy's current upstream doesn't cover (HashiCorp Vault, GCP API keys/OAuth tokens, Anthropic, OpenRouter, Stripe restricted keys, Twilio SIDs, URL-embedded git credentials, and more). Included by default in every project scan, or standalone via its own command. Match previews in every report are redacted.
• License compliance — every package's declared license is normalized (SPDX expressions, free text, npm's UNLICENSED proprietary marker vs. the SPDX Unlicense public-domain license, missing/unknown values) and checked against the OSI-approved license list, with a derived risk rating. Included by default in every project scan, or standalone via its own command (no vulnerability lookups, no secrets scan).
• Dependency graph with introduced-by and parent tracking
• Automatic report generation: timestamped JSON (*.json) + HTML (*.html) + SBOM (*.cdx.json) + SARIF (*.sarif.json) per scan, plus latest.* convenience links
• Zero external runtime dependencies (Node.js stdlib only)
• Complete compliant, and enriched SBOM Cyclonedx V1.6 files with full dependencies and vulnerabilities data in VEX
• Complete compliant, and enriched SARIF v2.1.0 files
• Reachability analysis — each vulnerability is annotated with a reachability level (total / high / medium / low) derived from package type, scope, dependency depth, attack vector, and import-scan confirmation across all supported ecosystems

Commands

All five commands are also accessible via the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) — search UBEL.

Installation

From the Marketplace

Search for UBEL in the VS Code Extensions panel

From VSIX

1. Download ubel-vscode-extension.vsix from the releases page.
2. Open the Command Palette → Extensions: Install from VSIX…
3. Select the downloaded file.

Scan Project (Ctrl+Alt+U)

Scans every ecosystem present anywhere inside the currently open workspace folder. Monorepos with mixed stacks are fully covered in a single pass — no configuration needed.

What gets scanned

Report location

<project-root>/.ubel/reports/latest.*

Scan VS Code Extensions (Ctrl+Alt+X)

Scans the npm packages bundled inside your installed VS Code / Cursor / VS Codium extensions (~/.vscode/extensions or ~/.vscode-oss/extensions or ~/.cursor/extensions). Extensions are a meaningful supply-chain surface — they run with full Node.js access in the editor host process and are updated silently.

Report location

~/.vscode/extensions/.ubel/reports/latest.*

or

~/.vscode-oss/extensions/.ubel/reports/latest.*

or

~/.cursor/extensions/.ubel/reports/latest.*

Scan Host Platform (Ctrl+Alt+P)

Audits the system-level software installed on the developer's machine itself — a distinct attack surface from project dependencies. Vulnerabilities are matched using CPE 2.3 identifiers against the CVE/NVD database.

This catches what dependency scanners miss: a vulnerable version of Git, an unpatched Python interpreter, an outdated Docker Desktop install, or an end-of-life .NET runtime.

Windows — detected via registry probes and PowerShell, no elevated privileges required:

Linux — reads the system package database directly, works as a standard user on most distributions:

On RPM-based systems, rpm -qa may return partial results depending on SELinux policy if run without elevated privileges.

Report location

The report is always written to ~/.ubel/reports/latest.*, independent of any open workspace.

~/.ubel/reports/latest.*

Scan for Exposed Secrets (Ctrl+Alt+S)

Runs a secrets-only pass over the open workspace folder — no dependency resolution, no package-manager calls. Built on Trivy's ported secret-scanning ruleset (Apache-2.0, see sca/vendor/trivy/NOTICE), extended with UBEL's own rules for vendors Trivy's current upstream doesn't cover:

• HashiCorp Vault tokens
• Google Cloud API keys and OAuth access tokens
• Anthropic and OpenRouter API keys
• Firebase tokens
• Stripe restricted keys (rk_live_ / rk_test_)
• Twilio Account/App SIDs
• Square and Braintree credentials
• Credentials embedded in a git remote URL (https://user:token@host/...)

Match previews shown in every report are redacted — the raw secret value is never written to disk, in this report or any other.

This scan also runs automatically as part of UBEL: Scan Project (Ctrl+Alt+U) — this command exists for when you want a fast, dependency-resolution-free pass, e.g. before a commit.

Report location

<project-root>/.ubel/reports/latest.*

This is the same path UBEL: Scan Project writes to. Running one after the other overwrites latest.* with whichever ran most recently — the timestamped copy under .ubel/local/reports/.../<date>/ from the earlier run is retained, but latest.* always reflects the most recent scan of either kind.

Scan for License Compliance (Ctrl+Alt+L)

Runs a license-only pass over the open workspace folder: full dependency resolution across every ecosystem present, license normalization and OSI-approval/risk classification — but no vulnerability lookups (no OSV.dev/NVD calls) and no secrets scan. Use this when you only need a license inventory (e.g. for legal/compliance review) without the time or network cost of a full vulnerability scan.

See License Compliance below for how licenses are normalized and classified — the classification logic is identical whether it runs standalone here or as part of UBEL: Scan Project.

This scan is also included automatically as part of UBEL: Scan Project (Ctrl+Alt+U) — this command exists for a faster, vulnerability-lookup-free pass when license data is all you need.

Report location

<project-root>/.ubel/reports/latest.*

This is the same path UBEL: Scan Project and UBEL: Scan project for Exposed Secrets write to. Running any of the three overwrites latest.* with whichever ran most recently — the timestamped copy under .ubel/local/reports/.../<date>/ from the earlier run is retained, but latest.* always reflects the most recent scan.

Scan Results

Every scan ends with a VS Code notification:

Every notification includes an Open Report button that opens the full interactive HTML report in your browser.

The HTML Report

Each scan produces a self-contained HTML file that works fully offline. It contains six tabs:

Reachability Analysis

Every vulnerability in the report is annotated with a reachability assessment. The analyzer operates on the existing report fields — package type, scope, dependency depth, CVSS attack vector, and the dependency graph — and performs a source-level import scan over the workspace files to confirm or refute whether the vulnerable package is actually used by application code.

The goal is prioritization: to separate vulnerabilities in packages your code actively exercises from those in packages that are installed but unreachable from any production code path.

Decision ladder

Signals are evaluated in strict priority order. The first matching rule wins.

Priority 0a (MAL-) — Malware advisories represent active supply-chain infections. The vulnerable code is the infection vector; reachability is unconditional regardless of how or whether the package is imported.

Priority 0b (env scope) — Packages carrying the env scope are part of the execution environment itself — OS packages, system libraries, runtimes, container-layer components. They are not imported by application code; they are the environment. Reachability is unconditional.

Priority 1 (non-library type) — Frameworks, applications, plugins, and OS-level packages have no meaningful import boundary. The component itself is the attack surface.

Priority 2 (dev/test scope) — Packages that are exclusively development or test dependencies are excluded from production runtimes.

Priorities 3–4 (import scan) — UBEL scans workspace source files for import statements matching the package. For transitive dependencies where the package itself is not directly imported, it checks whether any of the package's parents in the dependency graph are imported — confirming that the transitive path is exercised.

Priority 5 (orphan tool) — Root packages with no dependents and no import scan result are most likely standalone CLI tools not called by application code.

Priority 6 (heuristics) — When no higher-priority signal is available, depth in the dependency tree and the CVSS attack vector are used as weak proxies.

Import scan coverage

Reachability results appear in the Vulnerabilities tab of the HTML report and in the machine-readable JSON report under each vulnerability's reachability field.

License Compliance

Every project scan classifies each package's declared license by default. Licenses arrive in inconsistent shapes across ecosystems (SPDX ids, free text like "Apache 2.0", npm's UNLICENSED proprietary sentinel, Python trove classifiers, OR/AND SPDX expressions, or missing entirely); UBEL normalizes all of them to a canonical SPDX identifier, checks it against the OSI-approved license list, and assigns a risk rating:

npm's UNLICENSED sentinel (proprietary — all rights reserved) is deliberately not confused with the SPDX Unlicense public-domain license; dual-licensed packages (OR) are classified using the most favorable option, since the consumer may legally choose it.

Run standalone via UBEL: Scan project for License Compliance (Ctrl+Alt+L) — see above — when you want license data only, with no vulnerability lookups or secrets scan.

Results appear in the Inventory tab of the HTML report (per-package license, OSI-approved status, and risk) and in the machine-readable JSON/SBOM/SARIF reports under each package's license_info field.

Policy

All package managers share the same policy engine. Policy is stored per-project in .ubel/local/policy/config.json.

The threshold is inclusive — high blocks both high and critical. Setting none disables severity blocking but infections are still blocked.

Coverage at a Glance

Repos and Monorepos

UBEL walks the entire directory tree and detects all supported ecosystems in a single pass — no per-language configuration needed. Monorepos with mixed stacks (e.g. a Node.js frontend, Python backend, and Rust service in the same repo) are fully covered in one invocation.

Developer Machines

The VS Code extension (Ctrl+Alt+P) and the ubel-platform CLI binary scan the host machine: OS, installed runtimes, browsers, developer tools, and security software. Vulnerabilities are matched using CPE 2.3 identifiers against the CVE/NVD database.

This surface catches what dependency scanners miss — a vulnerable version of Git, an unpatched Python interpreter, or an outdated Docker Desktop install.

Windows

Detected via registry probes and PowerShell — no elevated privileges required.

Linux

Detected by reading the system package database directly.

On RPM-based systems, rpm -qa may return partial results depending on SELinux policy if run without elevated privileges.

Supported Ecosystems (Project Scan)

Reports

Every scan writes a self-contained interactive HTML + JSON + SBOM + SARIF reports.

Previous scans are retained under:

• <project-root>/.ubel/local/reports/npm/health/<year>/<month>/<day>/
• ~/.vscode/extensions/.ubel/local/reports/npm/health/<year>/<month>/<day>/
• ~/.vscode-oss/extensions/.ubel/local/reports/npm/health/<year>/<month>/<day>/
• ~/.cursor/extensions/.ubel/local/reports/npm/health/<year>/<month>/<day>/
• ~/.ubel/local/reports/npm/health/<year>/<month>/<day>/

Requirements

• Node.js >=18.0.0
• VS Code ^1.85.0 (extension only)

Privacy

UBEL is fully local. The only external calls are to osv.dev's public API and NVD's API, which receive package PURLs (package name + version) to check for known vulnerabilities. No file contents, no dependency graphs, no machine identifiers, and no telemetry are sent anywhere. Secrets findings never leave the machine at all — match previews shown in reports are redacted before being written to disk.

Both endpoints can be redirected to an internal mirror by setting UBEL_OSV_ENDPOINT / UBEL_NVD_ENDPOINT in the environment the editor was launched from (e.g. via VS Code's own terminal.integrated.env.* settings, or the OS environment) — useful for air-gapped or regulated environments where even those two calls need to stay on an internal network. See node/sca/README.md for details; this extension reads the same engine, so the same variables apply.

License

Free for scanning your own projects and systems.
See LICENSE.md for details or contact ala.bouali.1997@gmail.com for commercial licensing.