@codingame/monaco-vscode-github-authentication-default-extension@38.1.3
Default VSCode extension designed to be used with @codingame/monaco-vscode-api
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source shows runtime telemetry reporting sign-in events and requested scopes to Microsoft’s telemetry service. VS Code’s usage-telemetry setting gates these events, but the package documentation does not disclose the reporting, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The GitHub authentication provider creates a telemetry reporter from the extension’s configured telemetry key.
- Usage telemetry is sent through VS Code’s telemetry logger, which checks whether usage telemetry is enabled.
- On sign-in, the extension reports a `login` event with the requested authentication scopes.
- The bundled telemetry SDK contains Microsoft’s OneCollector endpoint.
- The package is a VS Code GitHub authentication extension, and its network activity supports that purpose.
- The reported login scopes are tied to a sign-in request; the source does not show GitHub access tokens being sent to the telemetry endpoint.
- Telemetry events use VS Code’s usage-telemetry preference, so they are not sent when usage telemetry is disabled.
Source & flagged code
4 flaggedThe GitHub authentication provider creates a telemetry reporter from the extension’s configured telemetry key.
resources/extension.jsView on unpkg · L17Usage telemetry is sent through VS Code’s telemetry logger, which checks whether usage telemetry is enabled.
resources/extension.jsView on unpkg · L13Findings
Affected versions and remediation
This report applies to @codingame/monaco-vscode-github-authentication-default-extension@38.1.3.
See all versions of @codingame/monaco-vscode-github-authentication-default-extension for other recorded verdicts.
- Review the evidence and your use of @codingame/monaco-vscode-github-authentication-default-extension@38.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.