Dev-Guard – Defend Against Supply Chain Malware

✅ Download the latest version of dev-guard here.

• DevGuard scans your extensions and alerts you instantly on anything malicious

| Runs automatically on startup, no setup required. | Detects extension changes the moment they happen. | Neutralize malicious extensions instantly. | | Pulls the latest malicious-package advisories from pkgscan.dev. | Matches installed extensions and versions against multi-engine scan verdicts. | Built on the standard VS Code extension API, so it works across Cursor, Windsurf, VSCodium, and other AI IDEs. |

• Live advisories. Every scan checks your extensions against the publicpkgscan.dev malicious-extension feed for VS Code, Cursor, and Open VSX. The feed refreshes every 5 minutes, and installing an extension triggers an immediate scan.
• Removal. Flagged extensions are uninstalled automatically by default (devGuard.removalMode :auto ·manual ·warn ) and removed again if reinstalled. Add an ID todevGuard.allowlist to opt one out. Every removal links to acleanup guide for what to do next.
• Side pane. The shield in the Activity Bar shows your current verdict, lets you run a scan and change settings, and keeps a scan log, removed list, audit log, and a hashed inventory of what was checked. Everything is stored locally.
• Remote windows. DevGuard sees the extensions in its own window; for SSH, WSL, or Dev Containers, install it in the remote as well.

DevGuard sends pseudonymous usage stats to pkgscan.dev so we can tell whether it is working in the field. Turn it off with devGuard.telemetry.enabled, or by disabling your editor's telemetry.

• Sent: scan outcomes, which extensions were flagged or removed (ID, version, severity), buttons clicked, extension and editor versions, OS, and a random install ID.
• Never sent: file paths, extension display names, advisory text, or machine identifiers.

Spotted a shady extension? 🕵️♂️

• Report it at pkgscan.dev . Confirmed advisories reach DevGuard through the pkgscan.dev advisories API.