Is "Rocket Commit" on VS Code Marketplace Safe to Install?

joncode ยท vscode ยท v1.0.4

# Rocket Commit **Generate intelligent commit messages with AI - 100% local and private** Rocket Commit is a Visual Studio Code extension that uses local artificial intelligence to automatically generate descriptive commit messages based on your code changes. No internet connection or external APIs required after initial setup. ## โœจ Features - ๐Ÿค– **Local AI**: Uses the Qwen2.5-Coder-1.5B model running entirely on your machine - ๐Ÿ”’ **Total Privacy**: Your code never leaves your computer - ๐Ÿ“ **Descriptive Commits**: Generates messages following commit conventions - โšก **Fast and Efficient**: Optimized model (Q4_K_M) for performance - ๐Ÿš€ **Easy to Use**: One click from the Source Control panel - ๐ŸŒ **Works Offline**: After downloading the model, no connection required ## ๐Ÿ“‹ Requirements - Visual Studio Code v1.97.0 or higher - Node.js (recommended: LTS version) - Disk space: ~1GB for the AI model ## ๐Ÿš€ Installation 1. Install the extension from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=Jonpena.rocket-commit) 2. On first use, the extension will automatically download the AI model (~900MB) 3. Ready to use! ## ๐Ÿ’ก Usage 1. **Stage your changes**: Use `git add` to prepare the files you want to commit ```bash git add . ``` 2. **Generate the message**: Click the rocket icon (๐Ÿš€) in the Source Control toolbar 3. **Review and confirm**: The generated message will appear in the input box. Review it and commit ### From Command Palette You can also use the command from the command palette (Ctrl/Cmd + Shift + P): ``` Generate Commit with AI ``` ## ๐Ÿ”ง How It Works 1. **Analysis**: The extension obtains the diff of staged changes (`git diff --staged`) 2. **Processing**: Filters and cleans the diff to focus on relevant changes 3. **Generation**: The AI model analyzes the changes and generates a descriptive message 4. **Optimization**: Post-processes the message to comply with best practices ### Technologies Used - **[node-llama-cpp](https://github.com/withcatai/node-llama-cpp)**: Runs LLM models locally in Node.js - **[Qwen2.5-Coder-1.5B](https://huggingface.co/Qwen/Qwen2.5-Coder-1.5B)**: Code-specialized model - **Q4_K_M Quantization**: Optimal balance between performance and quality ## ๐Ÿ“ Configuration The model comes configured with optimized parameters: ```typescript { maxTokens: 80, // Maximum message length temperature: 0.4, // Moderate creativity topP: 0.95, // Response diversity topK: 50 // Number of candidate tokens } ``` ## ๐Ÿ—‚๏ธ Project Structure ``` vscode-rocket-commit/ โ”œโ”€โ”€ src/ โ”‚ โ”œโ”€โ”€ commands/ # Extension commands โ”‚ โ”œโ”€โ”€ services/ # Business logic (Git, AI, HTTP) โ”‚ โ”œโ”€โ”€ providers/ # VSCode providers โ”‚ โ”œโ”€โ”€ utils/ # Utilities and helpers โ”‚ โ””โ”€โ”€ constants/ # Configuration and constants โ”œโ”€โ”€ images/ # Visual resources โ””โ”€โ”€ dist/ # Compiled build ``` ## ๐Ÿค Contributing Contributions are welcome! If you want to improve Rocket Commit: 1. Fork the repository 2. Create a branch for your feature (`git checkout -b feature/AmazingFeature`) 3. Commit your changes (`git commit -m 'Add some AmazingFeature'`) 4. Push to the branch (`git push origin feature/AmazingFeature`) 5. Open a Pull Request ### Local Development ```bash # Clone the repository git clone https://github.com/joncodeofficial/vscode-rocket-commit.git # Install dependencies npm install # Compile in watch mode npm run watch # Run tests npm test # Linting npm run lint ``` ## ๐Ÿ“ Changelog See [CHANGELOG.md](https://github.com/joncodeofficial/vscode-rocket-commit/blob/HEAD/CHANGELOG.md) to learn about changes in each version. ## ๐Ÿ› Report Issues Found a bug? [Open an issue](https://github.com/joncodeofficial/vscode-rocket-commit/issues) ## ๐Ÿ“„ License This project is licensed under the Apache 2.0 License. See the [LICENSE](https://github.com/joncodeofficial/vscode-rocket-commit/blob/HEAD/LICENSE) file for more details. ## ๐Ÿ™ Acknowledgments - [Qwen Team](https://github.com/QwenLM) for the Qwen2.5-Coder model - [node-llama-cpp](https://github.com/withcatai/node-llama-cpp) for the inference library - The VSCode community for the tools and documentation ## ๐Ÿ“ง Contact Jonathan - [@joncodeofficial](https://github.com/joncodeofficial) Project Link: [https://github.com/joncodeofficial/vscode-rocket-commit](https://github.com/joncodeofficial/vscode-rocket-commit) --- **Like Rocket Commit?** โญ Star the repo and share it with other developers!

Risk Assessment

Analyzed
63.05
out of 100
MEDIUM

4065 security findings detected across all analyzers

VS Code extension analyzed via package manifest and static code analysis

Severity Breakdown

0
Critical
1432
High
2631
Medium
2
Low
0
Info

Finding Categories

1000
Malware Signatures

YARA Rules Matched

15 rules(1000 hits)
postinstall network communication postinstall file manipulation postinstall environment access postinstall system command UsingCommandLineArguments postinstall obfuscation credential env files postinstall crypto operations postinstall file download UsingShellInterpreterWhenExecutingOSCommands postinstall persistence mechanism OriginsNotVerified NoUseWeakRandom DebuggerStatementsShouldNotBeUsed postinstall registry modification

About This Extension

# Rocket Commit **Generate intelligent commit messages with AI - 100% local and private** Rocket Commit is a Visual Studio Code extension that uses local artificial intelligence to automatically generate descriptive commit messages based on your code changes. No internet connection or external APIs required after initial setup. ## โœจ Features - ๐Ÿค– **Local AI**: Uses the Qwen2.5-Coder-1.5B model running entirely on your machine - ๐Ÿ”’ **Total Privacy**: Your code never leaves your computer - ๐Ÿ“ **Descriptive Commits**: Generates messages following commit conventions - โšก **Fast and Efficient**: Optimized model (Q4_K_M) for performance - ๐Ÿš€ **Easy to Use**: One click from the Source Control panel - ๐ŸŒ **Works Offline**: After downloading the model, no connection required ## ๐Ÿ“‹ Requirements - Visual Studio Code v1.97.0 or higher - Node.js (recommended: LTS version) - Disk space: ~1GB for the AI model ## ๐Ÿš€ Installation 1. Install the extension from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=Jonpena.rocket-commit) 2. On first use, the extension will automatically download the AI model (~900MB) 3. Ready to use! ## ๐Ÿ’ก Usage 1. **Stage your changes**: Use `git add` to prepare the files you want to commit ```bash git add . ``` 2. **Generate the message**: Click the rocket icon (๐Ÿš€) in the Source Control toolbar 3. **Review and confirm**: The generated message will appear in the input box. Review it and commit ### From Command Palette You can also use the command from the command palette (Ctrl/Cmd + Shift + P): ``` Generate Commit with AI ``` ## ๐Ÿ”ง How It Works 1. **Analysis**: The extension obtains the diff of staged changes (`git diff --staged`) 2. **Processing**: Filters and cleans the diff to focus on relevant changes 3. **Generation**: The AI model analyzes the changes and generates a descriptive message 4. **Optimization**: Post-processes the message to comply with best practices ### Technologies Used - **[node-llama-cpp](https://github.com/withcatai/node-llama-cpp)**: Runs LLM models locally in Node.js - **[Qwen2.5-Coder-1.5B](https://huggingface.co/Qwen/Qwen2.5-Coder-1.5B)**: Code-specialized model - **Q4_K_M Quantization**: Optimal balance between performance and quality ## ๐Ÿ“ Configuration The model comes configured with optimized parameters: ```typescript { maxTokens: 80, // Maximum message length temperature: 0.4, // Moderate creativity topP: 0.95, // Response diversity topK: 50 // Number of candidate tokens } ``` ## ๐Ÿ—‚๏ธ Project Structure ``` vscode-rocket-commit/ โ”œโ”€โ”€ src/ โ”‚ โ”œโ”€โ”€ commands/ # Extension commands โ”‚ โ”œโ”€โ”€ services/ # Business logic (Git, AI, HTTP) โ”‚ โ”œโ”€โ”€ providers/ # VSCode providers โ”‚ โ”œโ”€โ”€ utils/ # Utilities and helpers โ”‚ โ””โ”€โ”€ constants/ # Configuration and constants โ”œโ”€โ”€ images/ # Visual resources โ””โ”€โ”€ dist/ # Compiled build ``` ## ๐Ÿค Contributing Contributions are welcome! If you want to improve Rocket Commit: 1. Fork the repository 2. Create a branch for your feature (`git checkout -b feature/AmazingFeature`) 3. Commit your changes (`git commit -m 'Add some AmazingFeature'`) 4. Push to the branch (`git push origin feature/AmazingFeature`) 5. Open a Pull Request ### Local Development ```bash # Clone the repository git clone https://github.com/joncodeofficial/vscode-rocket-commit.git # Install dependencies npm install # Compile in watch mode npm run watch # Run tests npm test # Linting npm run lint ``` ## ๐Ÿ“ Changelog See [CHANGELOG.md](https://github.com/joncodeofficial/vscode-rocket-commit/blob/HEAD/CHANGELOG.md) to learn about changes in each version. ## ๐Ÿ› Report Issues Found a bug? [Open an issue](https://github.com/joncodeofficial/vscode-rocket-commit/issues) ## ๐Ÿ“„ License This project is licensed under the Apache 2.0 License. See the [LICENSE](https://github.com/joncodeofficial/vscode-rocket-commit/blob/HEAD/LICENSE) file for more details. ## ๐Ÿ™ Acknowledgments - [Qwen Team](https://github.com/QwenLM) for the Qwen2.5-Coder model - [node-llama-cpp](https://github.com/withcatai/node-llama-cpp) for the inference library - The VSCode community for the tools and documentation ## ๐Ÿ“ง Contact Jonathan - [@joncodeofficial](https://github.com/joncodeofficial) Project Link: [https://github.com/joncodeofficial/vscode-rocket-commit](https://github.com/joncodeofficial/vscode-rocket-commit) --- **Like Rocket Commit?** โญ Star the repo and share it with other developers!

Detailed Findings

1000 total

YARA Rule Matches

15 rules

Security Analysis Summary

Security Analysis Overview

Rocket Commit is a Visual Studio Code Marketplace extension published by joncode. Version 1.0.4 has been analyzed by the Risky Plugins security platform, receiving a risk score of 63.05/100 (MEDIUM risk) based on 4065 security findings.

Risk Assessment

This extension presents high security risk. Significant concerns were identified during analysis. It is not recommended for use in sensitive or production environments without thorough review.

Findings Breakdown

  • High: 1432 finding(s)
  • Medium: 2631 finding(s)
  • Low: 2 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Rocket Commit is published by joncode on the Visual Studio Code Marketplace marketplace. The extension has approximately 3 users.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Frequently Asked Questions