Marketplace Threat Tracker

A live count of extensions officially pulled from the VS Code Marketplace for malicious intent. The threat to the ecosystem is real, ongoing, and growing.

updating…

Confirmed malicious extensions removed

Past 7 days

Past 90 days

 

Breakdown by category

Removals over time

Loading trend…

Confirmed-threat removals per month. Administrative removals (owner requests, deprecations, expired domains) are excluded from these figures.

We watch the list so you don't have to

These extensions weren't flagged until after they were already installed by developers around the world. By the time an extension lands on this list, the damage may already be done.

VSCan continuously cross-references your monitored extensions against this list. If one of yours is ever removed for malicious intent, we tell you immediately — so you can uninstall it and rotate any credentials it could have reached.

Start monitoring your extensions arrow_forward