github.com / dotnet

dotnet/vscode-csharp

TypeScript·834 files·commit 1833384·scanned 4d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 3,078 stars — findings likely legitimate code patterns

verdict accurate?

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/shared/assets.ts. This means the suspicious code can execute when the app runs.+8

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.src/shared/assets.ts+3

infoSuspicious file in repoVery large source file (571KB) — could contain obfuscated payload.vscode/dnceng-schema.json+2

infoSuspicious file in repoExecutable file (Get-GitHubAppToken.ps1) in repositoryazure-pipelines/Get-GitHubAppToken.ps1+2

infoSuspicious file in repoExecutable file (Publish-Vsix.ps1) in repositoryazure-pipelines/Publish-Vsix.ps1+2

infoAuthor has no other public repositoriesGitHub user "dotnet-policy-service[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

531 files scanned @ 1833384 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution8

network & exfiltration0

file system access0

obfuscation3

supply chain14

owasp / injection0

telemetry

files 531/834rules hit 6engine v7commit 1833384

github

dotnet/vscode-csharp

Official C# support for Visual Studio Code

TypeScript

3078

741

3983d

834 files

531 scanned(64%)

1833384

architecture░▒▓

entry (1) flagged (1) pkg (56)

456 nodes · 1797 edgesscroll to zoom · click node to jump to finding