pyobfus for VS Code

Inline obfuscation-risk diagnostics and reverse-mapped stack traces for pyobfus, the open-source AST-based Python code obfuscator.

Install

Published to both registries at the same version:

• VS Code Marketplace — https://marketplace.visualstudio.com/items?itemName=zhurong2020.pyobfus
• Open VSX — https://open-vsx.org/extension/zhurong2020/pyobfus (for VSCodium, Gitpod, Eclipse Theia, code-server and other builds that cannot reach the Microsoft Marketplace)

Publisher is zhurong2020 on both. The extension shells out to your own locally-installed pyobfus — see Requirements.

Why trust this extension

This category has a documented trust problem, and it's getting worse, not better. In April 2025, a malicious extension named "Python Obfuscator for VSCode" was part of a 10-extension malware campaign that reached 300,000+ installs before removal (it deployed the XMRig cryptominer via a PowerShell loader). More recently, in May 2026, a trojanized update of Nx Console — a VS Code extension with ~2.2M installs and Marketplace's own "Verified Publisher" badge — shipped a credential stealer that ran on a GitHub employee's machine. The badge didn't stop it: "Verified Publisher" only confirms domain ownership, not code safety, and security researchers now explicitly warn that install counts and verified badges "end up actually working against you." This extension is not asking you to trust a badge — every claim below is independently checkable, not just asserted:

• Fully open source: github.com/zhurong2020/pyobfus, Apache-2.0.
• OpenSSF Best Practices verified — the underlying pyobfus project holds the passing badge.
• PEP 740 attested PyPI releases — every pyobfus release is published via OIDC Trusted Publishing with cryptographic build attestations, independently verifiable via PyPI's integrity API.
• Zero open CodeQL alerts — static analysis runs on every push; check the current state yourself in the Security tab.
• SHA-pinned CI/CD — every third-party GitHub Action in the build, test, and release workflows is pinned to a specific commit SHA, not a mutable tag, closing the exact supply-chain vector the Nx Console incident exploited elsewhere.
• A build-provenance manifest (--provenance-manifest) and a tool-description integrity manifest (pyobfus-mcp-verify, for the companion MCP server) — both self-consistency-checkable, not just claimed.
• No telemetry, no network calls beyond the explicit, user-initiated "Unlock Pro" link. This extension only ever shells out to your own locally-installed pyobfus.

Features

Inline risk diagnostics

Runs pyobfus --check on every save and surfaces findings (dynamic eval/exec, reflection, unsafe deserialization, and more) as native VS Code diagnostics — squiggly underlines + Problems panel, no extra extension required. If you already use Error Lens, pyobfus's findings get its enhanced inline treatment automatically.

Reverse stack traces

pyobfus's signature feature: obfuscated code still produces AI-debuggable tracebacks. Select (or copy) a mangled stack trace, run pyobfus: Reverse Stack Trace, pick the mapping.json from your build, and get the original identifiers back in a new tab — without ever exposing the mapping to whoever sent you the trace.

Status bar

Shows your current tier (Community/Trial/Pro) and the last check's result. Click it for a quick menu: check the workspace, generate a pyobfus.yaml, start a free trial, or unlock Pro — the trial/unlock items disappear once you're already on that tier.

Right-click obfuscate

Right-click a .py file or a folder in the Explorer (or inside an open Python file) → Obfuscate with pyobfus to run a real obfuscation build, not just the risk check, with an editable output path.

Pro trial / unlock

pyobfus: Start 5-Day Pro Trial (no credit card) and pyobfus: Unlock Pro Edition ($45 one-time, 30-day money-back guarantee) are also available from the Command Palette or the status bar menu.

Requirements

• Python 3.9+ with pyobfus installed (pip install pyobfus) in the interpreter VS Code is using for your workspace (the ms-python.python extension is used to detect this automatically).

Settings

Commands

Links

• pyobfus on GitHub
• pyobfus on PyPI
• Documentation
• Companion MCP server for Claude Code / Cursor / other AI coding agents

License

Apache-2.0.