Is litellm-vs-community safe to use?

litellm-vs-community has a security risk score of 100/100 (CRITICAL risk). Our security analysis detected 643 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of litellm-vs-community?

Based on our automated security analysis, litellm-vs-community presents critical risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

VS Code Marketplace

litellm-vs-community

Name: litellm-vs-community
Availability: InStock
Author: Eduard Novák

by Eduard Novák

1917b79b-a6c7-5ea9-9484-80def24abb62 | v0.1.0

Marketplace listing not found

Our last marketplace check could not find this listing in VS Code. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.

Not found on 2 weeks ago

CRITICAL risk

Risk verdict

Do not install

Score-based assessment (critical risk, 100/100). No analyst review available.

Analysis record

Analysed: 3 weeks ago
Version: v0.1.0
Artifact: SHA256 AE2…2DE
Source: Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

362 detail rows

Showing 25 of 207 · highest severity first

YARA Rule Matches

10 rules

Severity	Rule	Hits	Files	Metadata
HIGH	`CAP HookExKeylogger`	2	bin/Release/net48/Microsoft.VisualStudio.Utilities.dllbin/Release/net48/Microsoft.VisualStudio.Imaging.dll	Brian C. Bell -- @biebsmalwareguy FP 5%
LOW	`postinstall persistence mechanism`	1	Infrastructure/InputDialog.cs	-
LOW	`DebuggerStatementsShouldNotBeUsed`	11	bin/Release/net48/Microsoft.VisualStudio.Shell.15.0.dllbin/Release/net48/Microsoft.VisualStudio.Package.LanguageService.15.0.dllobj/vsix_opc/Community.VisualStudio.Toolkit.dll +8 more	-
LOW	`postinstall file download`	14	obj/x64/Release/net48/litellm-vs-community.assets.cachefiles.jsonobj/project.nuget.cache +11 more	-
LOW	`postinstall crypto operations`	19	Settings/LiteLLMOptionPage.csSettings/SettingsManager.csModels/ServerModels.cs +16 more	-
LOW	`postinstall environment access`	7	Settings/ServerRegistry.csSettings/SettingsManager.csInfrastructure/ServiceProviderExtensions.cs +4 more	-
LOW	`postinstall registry modification`	15	obj/Release/net48/litellm-vs-community.csproj.FileListAbsolute.txtobj/project.assets.jsonCommands/CommandHandlers.cs +12 more	-
LOW	`postinstall network communication`	24	Provider/SessionTracker.csobj/Debug/net48/litellm-vs-community.csproj.AssemblyReference.cacheobj/x64/Debug/net48/litellm-vs-community.assets.cache +21 more	-
LOW	`postinstall system command`	51	StatusBar/StatusBarService.csobj/x64/Release/net48/.NETFramework,Version=v4.8.AssemblyAttributes.csChat/ChatPartTemplateSelector.cs +48 more	-
LOW	`postinstall file manipulation`	11	Provider/ModelDiscovery.csProvider/Transport/ToolCallTagParser.csProvider/ChatClient.cs +8 more	-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

281 total

...

Network indicators are queued for lazy loading

Scroll this section into view to load the detailed rows.

Publisher Evidence

Limited evidence

Eduard Novák

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Noisy-finding weight

x1.00

Publisher domain

No domain

Missing

Store verification signal

Not exposed

Extension portfolio

Portfolio

12 evidence rows available.

Finding Categories

Malware Signatures

207

Obfuscation

281

IoC Indicators

YARA Rules Matched

10 rules(155 hits)

CAP HookExKeylogger postinstall persistence mechanism DebuggerStatementsShouldNotBeUsed postinstall file download postinstall crypto operations postinstall environment access postinstall registry modification postinstall network communication postinstall system command postinstall file manipulation

Security Analysis Summary

Security Analysis Overview

litellm-vs-community is a Visual Studio Code Marketplace extension published by Eduard Novák. Version 0.1.0 has been analyzed by the Risky Plugins security platform, receiving a risk score of 100/100 (CRITICAL risk) based on 643 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

Critical: 207 finding(s)
High: 2 finding(s)
Medium: 281 finding(s)
Low: 153 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

litellm-vs-community is published by Eduard Novák on the Visual Studio Code Marketplace marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

Use 100+ LLMs in Visual Studio with a built-in chat window powered by LiteLLM.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

Durable Functions Monitor

DurableFunctionsMonitor

CRITICAL 33K users

PSRuleM277hosturlnew

PRODM278DVT

CRITICAL

BOO UI编辑器

boo-best

CRITICAL 100 users

Kombai - Your AI design engineer

Kombai

CRITICAL 56K users

AL HERO - Productivity Toolkit for Business Central AL Developers

Yahya Touil

CRITICAL 72 users

VS Code Tools for WPF

LeXtudio Inc.

CRITICAL 4K users

litellm-vs-community

Analysis record

Evidence ledger

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.Language.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/VSLangProj80.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.Imaging.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Community.VisualStudio.Toolkit.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/zh-Hant/Microsoft.VisualStudio.Validation.resources.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/ja/Microsoft.VisualStudio.LanguageServer.Client.resources.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/zh-Hans/Microsoft.VisualStudio.LanguageServer.Client.resources.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/obj/vsix_opc/Microsoft.Xaml.Behaviors.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.TextManager.Interop.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.GraphModel.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.Language.StandardClassification.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.Diagnostics.Tracing.EventSource.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/pl/StreamJsonRpc.resources.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/fr/Microsoft.ServiceHub.Resources.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/obj/vsix_opc/litellm_vs_community.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.TextManager.Interop.11.0.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/envdte90.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.CommandBars.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.TextManager.Interop.12.0.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Nerdbank.Streams.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.CoreUtility.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/Microsoft.VisualStudio.ImageCatalog.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/de/Microsoft.ServiceHub.Framework.resources.dll-0

OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/Release/net48/zh-Hans/Microsoft.VisualStudio.Threading.resources.dll-0