Contains Vulnerability (CVSS Critical)

Flags items that contain or rely on components with critical severity vulnerabilities, as identified by sources such as Google OSV and NVD. These vulnerabilities may expose the item to exploitation, including risks like backdoors, privilege escalation, or data compromise.

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

Contains Vulnerability (CVSS High)

Flags items that contain or rely on components with high-severity vulnerabilities, as identified by sources such as Google OSV and NVD. These vulnerabilities may expose the item to exploitation, including risks like backdoors, privilege escalation, or data compromise.

This Visual Studio Code extension named "Guides" by spywhere provides enhanced indentation guides and visual cues within the editor to help users better understand code structure and indentation levels.

Key Functionalities:

  • Indentation Guides and Backgrounds: It calculates indentation levels for each line and applies decorations (visual guides) such as borders and background colors to indicate indentation.
  • Active and Stack Guides: Highlights the current active indentation level and optionally stacks guides for better visualization.
  • Gutter Icons: Displays open/close icons in the gutter for certain active guides.
  • Configuration Handling: Reads user and workspace settings to customize behavior, including enabling/disabling features, colors, widths, and styles.
  • Event Handling: Listens to editor events like cursor movement, active editor changes, and configuration changes to update guides dynamically.
  • Usage Statistics: Sends anonymous usage statistics to a remote server (https://api.digitalparticle.com/guides) via an HTTP POST request.

API and Network Activity:

  • Uses the request library to POST JSON data containing extension version, VSCode version, platform, architecture, and startup time to a remote analytics endpoint.

Filesystem and Process Activity:

  • No file creation, modification, or execution of external processes detected.

Obfuscation:

  • The code is well-structured and readable with no evidence of obfuscation techniques.

Potentially Notable Code Snippet (Network Communication):

request({
  uri: "https://api.digitalparticle.com/guides",
  method: "POST",
  body: data,
  json: true
}, (error, response, data) => { /* ... */ });

This snippet sends usage statistics to a remote server but does not send sensitive user data or code content.

GHSA-896r-f27r-55mw

json-schema is vulnerable to Prototype Pollution

CVSS:

9.8

GHSA-fjxv-7rqg-78g4

form-data uses unsafe random function in form-data for choosing boundary

CVSS:

9.4

GHSA-hrpp-h998-j3pp

qs vulnerable to Prototype Pollution

CVSS:

7.5