Before installing a VS Code extension, check the publisher, the reviews and Q&A, the linked source repository and license, and whether you actually need it. Extensions run with your permissions, so five minutes of review beats a quiet compromise of your laptop.
Start with the publisher
On the Marketplace page, look for the verified publisher mark. The VS Code documentation says a blue check means the publisher has proven ownership of a domain name, and the Marketplace has verified the domain and the publisher's good standing for at least six months.
A missing check is not proof of bad intent. It means you need more evidence from other signals.
Also check the exact name. The Marketplace works to prevent name squatting for official publishers and popular extensions, but a lookalike name still deserves a second read.
Read the signals the docs point to
The documentation suggests checking:
- Ratings and reviews. Read the negative ones.
- The Q&A tab, including whether the publisher responds.
- The linked issues repository.
- The license.
Look at the source yourself
If there is a repository link, open it. Check when it was last updated, who contributes, and whether the code matches what the extension claims. Look at package.json for the activation events and for scripts that run at install or build time. A formatter that wants to run on every startup and make network calls deserves a question.
Match the extension to a real need
Ask whether a built in feature already does the job. Every extra extension adds code with file, network and process access, as covered in what an extension can do.
Handle the publisher trust prompt properly
Since VS Code 1.97, the first install from a third party publisher asks you to confirm you trust that publisher. Trusting an extension pack or an extension with dependencies also trusts the publishers of the dependencies. Installs from the command line do not automatically trust the publisher, so do not use that route to skip the prompt thinking it is safer or quicker.
You can review the list with Extensions: Manage Trusted Extensions Publishers.
If something looks wrong
Use the Report a concern link in the extension's More Info section. The documentation says the Marketplace team responds within one business day. Then uninstall and think about what the extension could have read.
A five minute routine
Open the listing and the repository side by side. Check the publisher name matches the project. Read three recent issues and see whether anyone has reported surprising behaviour. Scan package.json for activationEvents and for scripts. Search the repository for network calls and for places the code reads files outside the project. You will not catch everything, and that is fine. The aim is to filter out the careless and the obviously suspicious, and to build the habit of looking before you install.
When to say no
Say no if the publisher cannot be matched to a real project, the listing copies a popular extension's description with a slightly different name, the repository link is missing or points somewhere unrelated, or the extension asks for far more reach than its purpose requires. Say no when a built in feature already does the job.
Quick check
Is the verified badge enough on its own?
No. It shows domain ownership and good standing for six months or more. You still need to judge the code and what you are granting.
Should I pin extension versions?
For sensitive environments, consider it. See the guide on extension auto update.
Sources
Last reviewed: 19 October 2026.
