DevGuard scans your extensions and alerts you instantly on anything malicious
✨ Features
🔍 Auto Scan
Runs automatically on startup, no setup required.
⚡ Real-Time Monitor
Detects extension changes the moment they happen.
🛑 One-Click Uninstall
Neutralize malicious extensions instantly.
📊 Live Advisories
Pulls the latest malicious-package advisories from pkgscan.dev.
🛰️ Verdict Checks
Matches installed extensions and versions against multi-engine scan verdicts.
🧩 IDE Native
Built on the standard VS Code extension API, so it works across Cursor, Windsurf, VSCodium, and other AI IDEs.
🔐 How it works
Live advisories. Every scan checks your extensions against the public pkgscan.dev malicious-extension feed for VS Code, Cursor, and Open VSX. The feed refreshes every 5 minutes, and installing an extension triggers an immediate scan.
Removal. Flagged extensions are uninstalled automatically by default (devGuard.removalMode: auto · manual · warn) and removed again if reinstalled. Add an ID to devGuard.allowlist to opt one out. Every removal links to a cleanup guide for what to do next.
Side pane. The shield in the Activity Bar shows your current verdict, lets you run a scan and change settings, and keeps a scan log, removed list, audit log, and a hashed inventory of what was checked. Everything is stored locally.
Remote windows. DevGuard sees the extensions in its own window; for SSH, WSL, or Dev Containers, install it in the remote as well.
Telemetry
DevGuard sends pseudonymous usage stats to pkgscan.dev so we can tell whether it is working in the field. Turn it off with devGuard.telemetry.enabled, or by disabling your editor's telemetry.
Sent: scan outcomes, which extensions were flagged or removed (ID, version, severity), buttons clicked, extension and editor versions, OS, and a random install ID.
Never sent: file paths, extension display names, advisory text, or machine identifiers.
🤝 Contribute
Spotted a shady extension? 🕵️♂️
Report it at pkgscan.dev. Confirmed advisories reach DevGuard through the pkgscan.dev advisories API.
