Codebase Guard

Codebase Guard checks an opened codebase for suspicious code and risky project configuration without running anything. It works across JavaScript and TypeScript projects, PHP and Laravel applications, Composer packages, Python, Ruby, shell scripts, CI files, editor tasks, containers, and common framework configuration.

It supports VS Code Restricted Mode: you do not need to trust a repository to scan it.

Safety boundary

At runtime Codebase Guard:

• reads workspace files through vscode.workspace.fs;
• never launches processes, terminals, tasks, Git, package managers, hooks, scripts, builds, or external binaries;
• never imports Node filesystem, process-launch, or network modules;
• never sends code, paths, hashes, telemetry, or findings over a network;
• never changes, deletes, quarantines, stages, commits, or pushes repository files;
• never writes into the repository; it only saves a report when requested and stores explicit allowlist/skip choices in VS Code user or workspace state.

This is a local developer safety layer, not a replacement for GitHub CI, Semgrep, CodeQL, secret scanning, EDR, code review, or incident response.

What it checks

• Known indicators from the referenced obfuscated postcss.config.mjs incident.
• Meaningful combinations of obfuscated identifiers, extremely long lines, dynamic execution, process launch, active network/download primitives, runtime decoders, high-entropy strings, and config-file context. Ordinary URLs, application fetches, and function declarations are not findings by themselves.
• Hidden executable-looking content appended after a normal config export and a large whitespace gap.
• Suspicious npm and Composer scripts that may run during install, update, packaging, or project setup.
• Non-registry npm dependency sources.
• PHP execution, download, and decoding combinations in Laravel and other PHP codebases.
• Common project files such as composer.json, artisan, Laravel config/ and routes/, pyproject.toml, requirements*.txt, Pipfile, Gemfile, Cargo.toml, go.mod, Maven/Gradle files, Docker files, and framework configs.
• Download-and-execute chains in shell, PowerShell, Git hooks, and VS Code task/debug files.
• Potentially exposed .env files when a simple local ignore-rule check finds no match (worded as a prompt to verify with Git, not a claim that the file is tracked).
• Oversized security-sensitive configs, which are reported even when content is not read.

The UI uses three actionable severities:

• Critical — known IOC or strong malicious/obfuscated combination. Do not execute the repository.
• High — risky behavior in an execution-sensitive context that needs prompt review.
• Review — a single weak signal or unusual configuration that may be legitimate.

Scores organize warnings by urgency. A warning is a clue to review, not proof that a file is malicious.

Commands

• Codebase Guard: Scan Workspace
• Codebase Guard: Scan Current File
• Codebase Guard: Show Findings
• Codebase Guard: Export JSON Report
• Codebase Guard: Manage Skipped Files and Folders
• Codebase Guard: Skip This File or Parent Folder…

The Codebase Guard control center shows whether automatic scanning is active and gives one recommended next action. When a finding appears, open it and review the flagged code. You can then hide only that exact warning or skip its file or any parent folder. Findings also appear in the Problems panel and status bar.

Settings and Restricted Mode

The existing frontendGuard.* setting names remain unchanged so updates do not break saved settings. While a workspace is untrusted, Codebase Guard reads only user/default values and ignores repository-controlled workspace values.

The finding row provides two explicit actions: hide only the reviewed finding fingerprint in User settings, or skip its exact file or any parent folder in the opened codebase. Folder choices are derived directly from the finding path, so no Finder dialog or full-codebase picker is required. Critical findings require a deliberate modal confirmation before either action can hide them.

Default discovery excludes generated/dependency areas such as node_modules, .git (except .git/hooks), dist, build, out, coverage, .next, .nuxt, vendor, and caches. Use the folder action beside a finding to skip its file or choose any ancestor folder, or use Manage skipped items in the Control Center to restore and manually manage exclusions. These selections apply only to the opened codebase and are stored in VS Code/Cursor workspace state, outside the repository, so an untrusted repository cannot configure its own hiding rules. Add exclusions cautiously: broad exclusions reduce coverage.

Install the private VSIX

VS Code

1. Open Extensions.
2. Select the … menu.
3. Choose Install from VSIX….
4. Select codebase-guard-0.1.2.vsix.
5. Reload VS Code, open the unfamiliar codebase, and keep it in Restricted Mode while Codebase Guard scans.

Command-line alternative: code --install-extension /absolute/path/codebase-guard-0.1.2.vsix.

Cursor

1. Open Extensions.
2. Select the … menu.
3. Choose Install from VSIX….
4. Select codebase-guard-0.1.2.vsix and reload Cursor.

Command-line alternative, when the Cursor CLI is installed: cursor --install-extension /absolute/path/codebase-guard-0.1.2.vsix.

Development-only build

The installed extension never invokes development tools. Building the extension itself uses Node, TypeScript, tests, and vsce inside this extension project only:

npm install
npm test
npm run security:audit
npm run package

Remote workspaces

Analysis runs entirely inside the active VS Code extension environment and Codebase Guard creates no network connection. For local codebases this is local. With Remote SSH, WSL, Dev Containers, or Codespaces, VS Code may run this workspace extension in the remote workspace extension host.

See SECURITY.md and docs/RULES.md for the threat model, limitations, and rule behavior.