#supply chain

IDE Shepherd

Datadog

Real-time runtime protection against malicious extensions and supply chain attacks

ECZ-ID MCP Trust

ecocitizenz

Community free forever: local MCP X-Ray + change detection. Pro adds Trust Epochs, Secret Shield, Advanced Tool X-Ray + optional Local Trust Gate. Pro from GBP 12.99/mo.

ECZ-ID CI/CD Trust

ecocitizenz

Surface pipeline, release and provenance evidence before you ship.

ECZ-ID Dependency Security

ecocitizenz

Find dependency, lockfile and SBOM evidence gaps before you rely on them.

ECZ-ID SBOM Readiness

ecocitizenz

Review your software bill-of-materials evidence before you share it.

SBOM Lens

everbright-it

View SPDX and CycloneDX SBOMs, including cascading document hierarchies, right in your editor.

OWASP GitHub Workflow Updater

OWASP

Pin GitHub Actions to specific commits for enhanced security

Guardian — Glassworm & Malware Scanner

ankushlokhande

Glassworm & malware scanner for VS Code. Detects malicious workspace tasks, injected configs, fake fonts, and stealth propagation scripts across Git branches.

AppsecD

bira

Shift-left AppSec for VS Code & Cursor — SAST + secret scan on every commit, AI-powered fix suggestions, and a per-org governance dashboard. Powered by appsec.shiprocket.in.

FixedWidth Forge: Logistics Data Parser

Devotall

FixedWidth Forge (FW Forge) enables high-speed previewing and table-based exploration of legacy fixed-width and flat-file formats (COBOL, EDI, ERP/Mainframe exports) directly in VS Code. Simply define a YAML layout file to parse and visualize complex data structures without enterprise bloat.

npm-script-lens

Booyaka101

See what install scripts actually do — inline risk in package.json for npm/pnpm/yarn/bun allowlists, plus npm 12 migration checks.

AI-powered supply chain security. Intercepts npm and pip installs and scans with 5 AI agents. Works on macOS, Linux, and Windows. No Docker or server required.