registry / @codingame/monaco-vscode-github-authentication-default-extension / 38.0.3

@codingame/monaco-vscode-github-authentication-default-extension@38.0.3

⚠ Under review

Default VSCode extension designed to be used with @codingame/monaco-vscode-api

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The inspected code registers a GitHub authentication extension and its visible OAuth flows align with that purpose. The package snapshot omits the declared runtime API dependency, so its behavior remains unresolved and a clean verdict is not supported.

Static reason

No blocking static signals were detected.

Trigger

Using the package imports its declared API dependency; the snapshot does not include that dependency's source.

Impact

The available source does not establish malicious behavior, but the dependency's behavior cannot be assessed from this snapshot.

Mechanism

The package entrypoint registers a GitHub authentication extension, but the imported API dependency could not be inspected.

AI rationale

Evidence

package.jsonindex.js

Network endpoints3

github.com/vscode.dev/redirectinsiders.vscode.dev/redirect

Decision evidence

public snapshot

AI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares @codingame/monaco-vscode-api@38.0.3 as a dependency.
The entrypoint imports registerExtension from that dependency and registers the GitHub authentication extension.
The inspected login flow starts through createSession and proceeds through the extension's GitHub server login path.
The bundled OAuth flow opens the configured authorization server and requests an authorization code.
The package snapshot contains no source for the declared API dependency, so its behavior could not be assessed.

Evidence against

The package manifest has no lifecycle scripts.
The inspected extension code uses GitHub authentication and OAuth endpoints for sign-in and token exchange.
The inspected GitHub Enterprise URL validation rejects credentials, query strings, fragments, and GitHub.com hosts.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

5 flagged

package.jsonView file

17"main": "index.js", "module": "index.js", "types": "index.d.ts", "dependencies": { "@codingame/monaco-vscode-api": "38.0.3" } }

Low

Suspicious Dependency Evidence

The manifest declares @codingame/monaco-vscode-api@38.0.3 as a dependency.

package.jsonView on unpkg · L17

index.jsView file

1import { registerExtension } from '@codingame/monaco-vscode-api/extensions'; var manifest = {name:"github-authentication",displayName:"%displayName%",description:"%description%",p

Low

Suspicious Dependency Evidence

The entrypoint imports registerExtension from that dependency and registers the GitHub authentication extension.

index.jsView on unpkg · L1

resources/extension.jsView file

Findings

2 Medium6 Low

MediumNetwork

MediumStripped Provenance Metadataresources/extension.js

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidenceindex.js

LowAi Review Evidenceresources/extension.js

Affected versions and remediation

This report applies to @codingame/monaco-vscode-github-authentication-default-extension@38.0.3.

See all versions of @codingame/monaco-vscode-github-authentication-default-extension for other recorded verdicts.

Review the evidence and your use of @codingame/monaco-vscode-github-authentication-default-extension@38.0.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 21:06:04.086Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @codingame/monaco-vscode-github-authentication-default-extension / 38.0.3

@codingame/monaco-vscode-github-authentication-default-extension@38.0.3

⚠ Under review

Default VSCode extension designed to be used with @codingame/monaco-vscode-api

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Using the package imports its declared API dependency; the snapshot does not include that dependency's source.

Impact

The available source does not establish malicious behavior, but the dependency's behavior cannot be assessed from this snapshot.

Mechanism

The package entrypoint registers a GitHub authentication extension, but the imported API dependency could not be inspected.

AI rationale

Evidence

package.jsonindex.js

Network endpoints3

github.com/vscode.dev/redirectinsiders.vscode.dev/redirect

Decision evidence

public snapshot

AI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares @codingame/monaco-vscode-api@38.0.3 as a dependency.
The entrypoint imports registerExtension from that dependency and registers the GitHub authentication extension.
The inspected login flow starts through createSession and proceeds through the extension's GitHub server login path.
The bundled OAuth flow opens the configured authorization server and requests an authorization code.
The package snapshot contains no source for the declared API dependency, so its behavior could not be assessed.

Evidence against

The package manifest has no lifecycle scripts.
The inspected extension code uses GitHub authentication and OAuth endpoints for sign-in and token exchange.
The inspected GitHub Enterprise URL validation rejects credentials, query strings, fragments, and GitHub.com hosts.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

5 flagged

package.jsonView file

17"main": "index.js", "module": "index.js", "types": "index.d.ts", "dependencies": { "@codingame/monaco-vscode-api": "38.0.3" } }

Low

Suspicious Dependency Evidence

The manifest declares @codingame/monaco-vscode-api@38.0.3 as a dependency.

package.jsonView on unpkg · L17

index.jsView file

1import { registerExtension } from '@codingame/monaco-vscode-api/extensions'; var manifest = {name:"github-authentication",displayName:"%displayName%",description:"%description%",p

Low

Suspicious Dependency Evidence

The entrypoint imports registerExtension from that dependency and registers the GitHub authentication extension.

index.jsView on unpkg · L1

resources/extension.jsView file

Findings

2 Medium6 Low

MediumNetwork

MediumStripped Provenance Metadataresources/extension.js

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidenceindex.js

LowAi Review Evidenceresources/extension.js

Affected versions and remediation

This report applies to @codingame/monaco-vscode-github-authentication-default-extension@38.0.3.

See all versions of @codingame/monaco-vscode-github-authentication-default-extension for other recorded verdicts.

Review the evidence and your use of @codingame/monaco-vscode-github-authentication-default-extension@38.0.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 21:06:04.086Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.