Summary
Togoder Security scanned the VS Code Marketplace package togoder.togoder-security@0.1.0 on Nov 10, 2026. An AI review of 2 source files produced 4 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns that the package's purpose explains (dynamic code, telemetry, native installers, broad file or network access), not malware.
Findings 7
API key stored in editor secret storage and sent to vendor server
NPS-A85BA109887A
The extension stores a user-pasted Togoder Security API key in VS Code's SecretStorage (system keychain) and sends it as a Bearer token to the configured server (default https://security.togoder.click) for account/scan operations. This is the expected authentication mechanism for a commercial scanning service and the key is provided by the user, not harvested from unrelated locations.
Vendor telemetry / package inventory upload
NPS-580054201457
On load and on extension changes, the extension enumerates locally installed extensions (id and version) and POSTs them to the vendor's /api/extensions/check endpoint. This is core to the product's purpose (checking installed extensions against stored scan reports) and the destination is the vendor's own configurable server, not an arbitrary exfiltration host.
startup activation
NPS-33249393A5E4
activationEvents includes onStartupFinished, so the extension runs at every editor start. A malware scanner that wants to compare installed extensions against stored scan reports and surface status after installs plausibly needs to run at startup; it is discloseable but broad.
network and identifier disclosure
NPS-D7ABEE5287D0
The extension sends installed-extension ids and versions to the vendor's own server (security.togoder.click) without the API key; this is the scanner's own backend, is user-configurable via togoder.serverUrl, and is documented in the setting description. It is not credential exfiltration.
Installs/uninstalls extensions on user confirmation
NPS-C442F9056AD7
executeCommand('workbench.extensions.installExtension'/'uninstallExtension') is invoked only after explicit user interaction (scan-and-install flow, flagged-report prompt, or uninstall button). This is the stated purpose of a security extension that gates installation on a scan verdict.
Configuration mutation (global autoUpdate toggle)
NPS-89431607809D
togoder.turnOffAutoUpdate writes extensions.autoUpdate=false to global settings, but only after the user answers a confirmation prompt during the welcome flow. Legitimate security rationale; not silent modification.
self-modifying editor setting
NPS-B30E7B472266
Contributes a command that turns off 'extensions.autoUpdate' and a walkthrough step for it, changing the user's update behaviour. It is user-invoked and described, and it serves the package's stated scan-before-update purpose, not a silent hijack.
Files reviewed
| File | Verdict | Result |
|---|---|---|
| dist/extension.js | medium | 4 findings |
| package.json | medium | 3 findings |
Scanned versions of togoder.togoder-security
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 0.1.0 | Needs review | 2 | Nov 10, 2026 |
Frequently asked questions
Is togoder.togoder-security safe to use?
No confirmed malware was found in togoder.togoder-security@0.1.0, but the review flagged 4 medium, 3 low severity findings for risky patterns worth checking before you rely on it.
Does togoder.togoder-security contain malware?
No malware was identified in togoder.togoder-security@0.1.0 when Togoder Security scanned it on Nov 10, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was togoder.togoder-security checked?
Togoder Security downloaded the published VS Code Marketplace package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan togoder.togoder-security together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in togoder.togoder-security@0.1.0, cost nothing.