DugganUSA Threat Intel Scanner for VS Code

Scan your code for threat indicators in real-time. 1.5M+ IOCs. Cross-platform. Free registered key.

What It Does

Every IP address, domain, SHA256 hash, and CVE ID in your code is a potential indicator of compromise. This extension finds them automatically and checks each one against the DugganUSA threat intelligence index — the same STIX 2.1 feed trusted by 275+ organizations across 46 countries, including Fortune 500 security teams.

Open a file. Save a file. The scanner runs. Known-bad indicators appear as inline warnings with enrichment details — malware family, threat type, source, and cross-index hit count. No context switching. No browser tabs. No copy-paste into VirusTotal. The intelligence is in your editor where the code already is.

Example

You open a config file. Line 42 has a hardcoded IP: 185.39.19.176. The extension highlights it:

DugganUSA: 185.39.19.176 — IOC: Cobalt Strike C2 (via SSLBL) | Blocked 47x | In 3 OTX pulse(s) (12 cross-index hits)

Right-click, "View in DugganUSA" opens the full correlation in your browser.

Who It's For

• Security engineers reviewing infrastructure code, Terraform configs, Ansible playbooks — catch hardcoded C2 IPs before they ship
• SOC analysts triaging incident reports — paste an indicator, get instant enrichment without leaving the editor
• DevSecOps teams building CI/CD pipelines — scan PRs for known-bad indicators as part of code review
• Threat researchers writing reports — validate IOCs inline while documenting
• Anyone who touches config files, log snippets, or threat intelligence data in VS Code

Features

Why This Intel Is Worth Trusting — Now Provable Live

The IOC and CVE enrichment you see inline is only as good as the corpus behind it. As of this release, the DugganUSA platform exposes four live, no-auth, durable validation endpoints that let you (and your auditors) check feed quality for yourself — they survive deploys, so the numbers are real:

• Novelty — /api/v1/feed-uniqueness: measured live, roughly 75%+ of what we publish is NOT in ThreatFox. The hits you catch in your editor are largely ones other feeds miss.
• Timeliness — /api/v1/kev-lead: a live ledger of how far ahead of CISA KEV we flagged each exploited CVE — positive leads, same-day, and no-receipt all shown honestly, with receipts. That CVE-2026-21643 warning can land well before it shows up in the official catalog.
• Accuracy — /api/v1/spamhaus-validation: Spamhaus independently corroborates our first-hand contributions, an external accuracy signal on the calls we make.
• Liveness — /api/v1/feed-efficacy: opt-in consumer reports of when our indicators actually fire on real traffic — proof the feed is operationally live, not just large.

In short: the intel surfaced in your editor is sourced from a corpus that is independently novel, early, corroborated, and provably live. We cap our own claims at 95% honest confidence — there is always some noise, and we'd rather say so.

Getting Started

1. Install the Extension

From VS Code:

1. Open Extensions (Ctrl+Shift+X / Cmd+Shift+X)
2. Search for "DugganUSA Threat Intel"
3. Click Install

From the command line:

code --install-extension DugganUSALLC.dugganusa-threat-intel

For more on installing extensions, see the VS Code Extension Marketplace docs.

2. Get Your Free API Key (Required)

Visit analytics.dugganusa.com/stix/register. No credit card. No login. Takes 30 seconds.

The DugganUSA feed is API-key-enforced. Anonymous requests return 401; an unregistered Bearer token returns 429. The free tier is a free registered key — not anonymous access — so register first, then drop the key into your settings. The free key covers full query volume for normal in-editor use.

3. Configure

Open VS Code Settings (Ctrl+, / Cmd+,) and search for "DugganUSA":

Or edit settings.json:

{
  "dugganusa.apiKey": "dugusa_YOUR_KEY_HERE",
  "dugganusa.scanOnSave": true,
  "dugganusa.scanOnOpen": true
}

See VS Code User and Workspace Settings.

4. Start Coding

Open a file with IPs, domains, hashes, or CVEs. Check the Problems panel (Ctrl+Shift+M / Cmd+Shift+M).

Commands

Open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P):

What It Detects

Pricing

The extension is free and open source (MIT). The API has tiered rate limits:

Register at analytics.dugganusa.com/stix/register.

Prerequisites

• VS Code 1.85+
• Internet connectivity (degrades gracefully offline)
• Free API key recommended

Fully cross-platform — no native dependencies. Works on: Windows, macOS, Linux, WSL, Remote SSH, GitHub Codespaces, vscode.dev.

What's In The Index

1.5M+ indicators from:

• OTX AlienVault (16,800+ pulses)
• abuse.ch SSLBL + URLhaus
• Spamhaus DROP/EDROP
• CISA KEV (1,568 entries)
• DugganUSA original research (supply chain Pattern 38-48)
• Exploit harvester (84 rules, GitHub scanning every 6h)
• Edge honeypots (30 canary paths on Cloudflare Workers)

Cross-correlated across 65 indexes.

Also available as STIX 2.1 JSON, IP blocklist CSV, Domain CSV, Hash CSV.

Privacy

• Only IOC values sent to the API — never source code, file paths, or workspace metadata
• No telemetry beyond API lookups
• HTTPS only (TLS 1.2+)
• Local cache only — never persisted to disk
• Open source — inspect the code

Compatibility

This extension works out of the box on VS Code and VS Code forks:

Planned Integrations — Same Engine, More Surfaces

The DugganUSA threat intel scanning engine is designed to run anywhere developers and security teams work. The same IOC detection + API correlation pattern ports to every platform below. Contributions welcome.

IDEs & Editors

Browsers

Collaboration & Workflow

SIEM & Security Platforms

Data & Productivity

CLI & DevOps

Desktop Launchers

Want to Help Build One?

Every integration above uses the same core pattern: extract IOC → call API → render result. The DugganUSA correlation API is open and documented. If you want to build one of these integrations, open an issue or PR.

API docs: analytics.dugganusa.com/api/v1/search/stats

Free API key: analytics.dugganusa.com/stix/register

Development

See CONTRIBUTING.md for setup, testing, and publishing.

git clone https://github.com/pduggusa/dugganusa-vscode.git
cd dugganusa-vscode
code .
# Press F5 to launch Extension Development Host

See VS Code Extension API and Publishing Extensions.

Links

License

MIT — DugganUSA LLC, Minneapolis, MN.

Built by two people, one AI partner, and $75/month in infrastructure.

DugganUSA Defender Family

Same threat corpus, surfaced wherever you live. Open source, MIT licensed, receipts on every repo.

Backed by the live DugganUSA threat intel platform: analytics.dugganusa.com.

Jeevesus saves. Dredd judges.