To report a malicious VS Code extension, open its page in the Marketplace, find the "Report a concern" link at the bottom of the More Info section, and describe what you saw. Microsoft's documentation says the Marketplace team gives an initial response within one business day. Remove the extension from your own machines while you wait.
What the report triggers
According to the VS Code extension runtime security documentation, a reported extension that is verified as malicious is removed from the Marketplace and added to a block list. VS Code then uninstalls it automatically from machines where it was installed. The same path applies when a vulnerability is found in one of the extension's dependencies.
That block list is the part worth understanding. Your report is not only a complaint to a support desk. It can end up as a signal that reaches every installed copy. A clear, evidence-based report is therefore worth the ten minutes it takes.
Steps to report
- Open the extension's Marketplace page, not the in-editor view, so you can copy the exact publisher and extension ID.
- Scroll to the More Info section and select "Report a concern".
- State the behaviour in one sentence: for example, "sends file contents to an unlisted domain on activation".
- Add evidence: the version number, the domain or IP you observed, and how you saw it (a proxy log, a process list, a diff against the previous version).
- Note the date and time, so the team can correlate with other reports.
- Uninstall the extension and keep a copy of the package for your own records, stored somewhere it cannot run.
What to do on your side while you wait
A report does not undo what the extension already did. Treat the machine as exposed if the extension ran.
- List other installs. Check which developers and CI images have the same extension ID and version.
- Rotate credentials that were readable from the workspace or environment, starting with tokens in environment variables and cloud credentials on disk.
- Review recent changes from affected machines for commits you do not recognise.
- Record the extension ID in your internal block list or allowlist policy so it cannot return.
A table helps decide how urgent this is.
| Observation | Urgency | First action |
|---|---|---|
| Unexpected network calls to unknown hosts | High | Uninstall, rotate credentials, report |
| New permissions or commands after an update | Medium | Pin the previous version, report |
| Lookalike name of a popular extension | Medium | Compare publisher and report as impersonation |
| Poor quality but no harmful behaviour | Low | Leave a review, no security report |
Why a report still matters if the extension is signed
The Marketplace signs extensions when they are published, and VS Code checks that signature at install. The signature shows integrity and source, not intent. A malicious publisher can produce a validly signed package, which is why reports from users remain part of the defence. The documentation also describes malware scanning with several engines, a sandboxed behaviour check, and a six month good standing requirement for the verified publisher mark. None of those replace a human noticing something odd.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a fresh advisory gets matched to what you actually run, which is the same question you ask after reporting an extension.
Safeguard's asset discovery and SBOM and dependency scanning help you answer "where else do we run this?" across repositories and build images. You can try a free scan to see the output.
Quick check
Does reporting remove the extension from my machine?
No. Remove it yourself. The Marketplace can block and uninstall it later if the report is verified, but that takes time.
How fast does the Marketplace respond?
The documentation states an initial response within one business day. That is a first response, not a guaranteed removal time.
Should I report an extension that is just low quality?
Use a review for quality problems. Reserve security reports for malware, secret theft, impersonation and similar harm.
Sources
Last reviewed: 19 October 2026.
