Togoder Security: Extension Malware Scanner

Scan a VS Code extension for malicious code before you install it and before you update it.

An extension runs with all the rights of your editor: your files, your terminal, your SSH keys and tokens, the network. There is no sandbox. Togoder Security downloads the extension from the gallery, and an AI model reads every file in it. Nothing is run.

• The whole extension: its own code, the dependencies that it bundles (node_modules or one minified bundle), and its helper scripts (shell, PowerShell, batch, Python).
• Everything that it installs with it: extension packs and extension dependencies.
• Before install and before update: a result is a pass, a warning or an error, with the findings by file and line.
• Sign-in with an API key. No browser sign-in in the editor.
• Reports are shared. If another person scanned that version before, you see its result at once: free, and with no API key.
• The price is shown before each scan. Code that was scanned before is free.
• Visual Studio Marketplace and Open VSX (Cursor, VSCodium, Windsurf).

How to use it

Scan, then install

In the Extensions view, right-click an extension and choose Scan, Then Install….

You can also run Togoder Security: Scan, Then Install… from the Command Palette and type an id (publisher.name, or publisher.name@1.2.3), or paste a link to the extension's Marketplace or Open VSX page.

1. The server downloads the VSIX and counts the files that nobody scanned before. This quote is free.
2. If the scan is not free, a message shows the price. Nothing is charged until you confirm.
3. The result:

Install installs exactly the version that was scanned.

Scan before an update

1. Turn off the editor's automatic updates: Togoder Security: Turn Off Extension Auto Update (it sets extensions.autoUpdate to false).
2. The Togoder Security view in the Activity Bar shows each installed extension, its scan status, and newer releases.
3. Choose Scan Newest Release, Then Update. After the scan, Update installs exactly the version that was scanned.

The Togoder Security view

One line for each installed extension: no issues, a risk level, or not scanned. Flagged extensions are at the top and are counted in the status bar. Select a line to open its report, or to scan it if it has no report.

This lookup is free and uses no API key.

Sign in with an API key

1. On a device that you trust, open security.togoder.click/account and sign in there.
2. Create an API key for this machine. It is shown one time.
3. In the editor, run Togoder Security: Set API Key… and paste the key.

Why a key and not a browser sign-in: the editor never sees your Google or GitHub session. A machine that you do not fully trust holds one key. If you lose that machine, revoke that key on the account page; your account and your other keys do not change.

The key is kept in the editor's secret storage (the system keychain). It is not a setting: it is not written to settings.json and Settings Sync does not copy it. It is sent only to the server in the togoder.serverUrl setting, and only with the requests that need it (a paid scan, your balance).

Prices

You can pay for new files in two ways:

• Prepaid balance, pay per scan. Top up at security.togoder.click/account (from $20; tax is added at checkout where it applies). Before each paid scan a message shows the exact price, the number of new files, and your balance before and after. Unused balance does not expire, and you can refund it from the account page.
• Monthly plan. A number of tokens of new code per 30 days, from $30 per month. A scan on a plan charges no money. A scan over the plan's limit is refused; it is never charged to the balance in its place.

More facts about the price:

• The price of a scan comes from the size of the new files. A small extension costs cents. A large extension with many bundled dependencies costs more, and the message tells you before you pay.
• Files are matched by content. A dependency inside an extension is free if the same file was scanned in another extension or in a package from npm.
• If a scan fails, the charge comes back. If a part of it fails, that part comes back.
• Togoder Security: Account, Balance and Prices shows your balance and the current prices from the server. The full list is at security.togoder.click/pricing.
• The setting Prices: Confirm Above Usd lets small scans start without a question. Its default is 0: every paid scan asks.

Settings

Open them with Togoder Security: Open Settings.

Limits that you must know

• The editor has no hook before an install. An extension cannot stop the editor's own Install button or an automatic update. If you install that way, this extension tells you right after the install whether that version has a report, and the new extension can already be active. To scan first, use Scan, Then Install and turn off auto update.
• A report without findings is not a guarantee. The model reads the code; it does not run it. It lowers the risk and it can miss things.
• Native binaries are not reviewed, and files above the size limit are not reviewed. The report on the website lists them.
• Extensions with one build per platform are scanned for this machine's platform. Change it with togoder.targetPlatform.
• Extensions that are not in a gallery (installed from a .vsix file) cannot be scanned.

Privacy

• The extension sends: the id and version of the extension that you scan, and, for the status view, the ids and versions of your installed extensions. Turn the second one off with togoder.reports.lookupInstalled.
• It does not send your code, your workspace, or file names from your machine. The server downloads extensions from the gallery itself.
• No telemetry.
• Scan results are public reports on security.togoder.click, so the next person does not pay for the same files.
• The code of this extension is one file that is not minified (dist/extension.js), and it has no dependencies.

Terms · Privacy · Refunds