@vscode/vsce-sign
Visual Studio Code extension package signing and verification module
4
Versions
SEE LICENSE IN LICENSE.txt
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
vscode-botmicrosoft1es
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@vscode/vsce-sign-win32-arm | AI (phantom-deps): Platform binary package in same org, used indirectly via postinstall. | ai | |
| dependencies | unvetted-dep:@vscode/vsce-sign-win32-arm | AI (dependencies): First-party Microsoft platform binary package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used to invoke platform binary for signing; core functionality of this native-binding package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require reads own package.json to resolve optional dep version; not arbitrary module loading. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-linux-arm | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-linux-x64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-win32-x64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall installs platform-specific native binaries from same-org optional deps; documented pattern for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-darwin-x64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-linux-arm64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-win32-arm64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-alpine-arm64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-darwin-arm64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vscode/vsce-sign-alpine-x64 | AI (phantom-deps): Platform-specific optional dep loaded dynamically at runtime; phantom-dep false positive for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is used to strip npm_config_global before spawning npm install; not credential exfiltration. | ai |
v2.0.7
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.