# togoder.togoder-security@0.1.0 security report (VS Code Marketplace)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-11-10T19:40:06.000Z
- Files reviewed: 2
- Findings: 4 medium, 3 low severity findings
- Report: https://security.togoder.click/vscode/togoder.togoder-security
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the VS Code Marketplace package togoder.togoder-security@0.1.0 on Nov 10, 2026. An AI review of 2 source files produced 4 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns that the package's purpose explains (dynamic code, telemetry, native installers, broad file or network access), not malware.

## Findings

### [medium] API key stored in editor secret storage and sent to vendor server

Finding ID: `NPS-A85BA109887A`

File: `dist/extension.js`

The extension stores a user-pasted Togoder Security API key in VS Code's SecretStorage (system keychain) and sends it as a Bearer token to the configured server (default https://security.togoder.click) for account/scan operations. This is the expected authentication mechanism for a commercial scanning service and the key is provided by the user, not harvested from unrelated locations.

### [medium] Vendor telemetry / package inventory upload

Finding ID: `NPS-580054201457`

File: `dist/extension.js`

On load and on extension changes, the extension enumerates locally installed extensions (id and version) and POSTs them to the vendor's /api/extensions/check endpoint. This is core to the product's purpose (checking installed extensions against stored scan reports) and the destination is the vendor's own configurable server, not an arbitrary exfiltration host.

### [medium] startup activation

Finding ID: `NPS-33249393A5E4`

File: `package.json:43`

activationEvents includes onStartupFinished, so the extension runs at every editor start. A malware scanner that wants to compare installed extensions against stored scan reports and surface status after installs plausibly needs to run at startup; it is discloseable but broad.

### [medium] network and identifier disclosure

Finding ID: `NPS-D7ABEE5287D0`

File: `package.json:376`

The extension sends installed-extension ids and versions to the vendor's own server (security.togoder.click) without the API key; this is the scanner's own backend, is user-configurable via togoder.serverUrl, and is documented in the setting description. It is not credential exfiltration.

### [low] Installs/uninstalls extensions on user confirmation

Finding ID: `NPS-C442F9056AD7`

File: `dist/extension.js`

executeCommand('workbench.extensions.installExtension'/'uninstallExtension') is invoked only after explicit user interaction (scan-and-install flow, flagged-report prompt, or uninstall button). This is the stated purpose of a security extension that gates installation on a scan verdict.

### [low] Configuration mutation (global autoUpdate toggle)

Finding ID: `NPS-89431607809D`

File: `dist/extension.js`

togoder.turnOffAutoUpdate writes extensions.autoUpdate=false to global settings, but only after the user answers a confirmation prompt during the welcome flow. Legitimate security rationale; not silent modification.

### [low] self-modifying editor setting

Finding ID: `NPS-B30E7B472266`

File: `package.json:109`

Contributes a command that turns off 'extensions.autoUpdate' and a walkthrough step for it, changing the user's update behaviour. It is user-invoked and described, and it serves the package's stated scan-before-update purpose, not a silent hijack.

## Files reviewed

- `dist/extension.js` (medium): 4 findings
- `package.json` (medium): 3 findings

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology