TokenGuard Copilot
The AI review rates the findings as likely false positive, but the risk score (58/100) still counts them.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v1.7.0
- Artifact
- SHA256 570…4A7
- Source
- Findings (non-IoC)
Is TokenGuard Copilot safe?
Tokenguard Copilot lets you point VS Code's Copilot Chat at third-party AI providers instead of the built-in one, so you can use an OpenAI-compatible endpoint with whatever key you already have. That job explains the network calls in its code. The extension contacts api.openai.com, api.anthropic.com, api.groq.com and a handful of smaller providers, and the network findings in extension/out/extension.js are those fetch and socket calls. It declares no special permissions beyond what VS Code gives every extension.
The flagged domain list is mostly debris from reading minified JavaScript. Alongside real hosts like api.mistral.ai, it includes entries such as ci.show and document.documentelement.clientheight-s.top, which are fragments of code like document.documentElement.clientHeight and .show split at the dots and mistaken for web addresses. No malware signature matched, and nothing showed the extension opening .env files, SSH keys or cloud credentials, which is what matters most for an add-on whose whole job is holding an API key you give it.
The finding titled NET-FETCH-extension/out/extension.js-1 would be serious if it reached somewhere unexpected. Its destination is a model provider API, the same kind of call the extension exists to make. The low-severity code-quality flags all land on that one bundled file, extension/out/extension.js, which is normal build output for a network client rather than anything the extension does wrong.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
13 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall registry modification | 5 | out/webview/settings-app.js.mapchangelog.mdout/webview/settings-app.js +2 more | - |
| LOW | postinstall crypto operations | 4 | out/webview/settings-app.js.mapassets/models.dev.jsonout/webview/settings-app.js +1 more | - |
| LOW | postinstall file manipulation | 25 | changelog.mdout/db/migrations/20260609223630_lumpy_pet_avengers/migration.sqlout/db/migrations/20260520130114_free_christian_walker/snapshot.json +22 more | - |
| LOW | postinstall network communication | 10 | out/webview/settings-app.jschangelog.mdout/webview/codicon.css +7 more | - |
| LOW | postinstall obfuscation | 5 | assets/model/o200k_base.tiktokenout/webview/settings-app.js.mapout/webview/settings-app.js +2 more | - |
| LOW | postinstall system command | 10 | out/webview/codicon.ttfout/webview/codicon.cssassets/models.dev.json +7 more | - |
| LOW | postinstall file download | 9 | out/webview/settings-app.jsout/webview/codicon.cssout/extension.js +6 more | - |
| LOW | credential gcp credentials | 1 | assets/models.dev.json | - |
| LOW | SQLInjection | 1 | out/webview/settings-app.js | - |
| LOW | NoUseWeakRandom | 3 | out/webview/settings-app.jsout/extension.jsout/webview/settings-app.js.map | - |
| LOW | credential env files | 2 | out/extension.jsout/webview/settings-app.js.map | - |
| LOW | APT1 WEBC2 Y21K | 1 | assets/model/o200k_base.tiktoken | - |
| LOW | postinstall persistence mechanism | 3 | package.jsonchangelog.mdout/webview/settings-app.js.map | - |
Publisher Evidence
Lowadguard
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
13 evidence rows available.
Finding Categories
YARA Rules Matched
13 rules(79 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
What this extension does
tokenguard-copilot (publisher adguard, OpenVSX, version 1.7.0, about 9,100 users) plugs third-party OpenAI-compatible model providers into VS Code Copilot Chat. That job description accounts for nearly every finding here. The extension declares no permissions and no host permissions.
Network and process access
The four network findings all sit in one file: NET-FETCH-extension/out/extension.js-1, NET-FETCH-extension/out/extension.js-47, NET-FETCH-extension/out/extension.js-49, and NET-SOCKET_IO-extension/out/extension.js-44. Fetch calls and a socket construct at those lines are the plumbing a chat provider needs to stream completions. The endpoint list supports that reading: api.openai.com, api.anthropic.com, api.groq.com, api.mistral.ai, api.cerebras.ai, api.cohere.com, api.together.xyz, api.deepinfra.com, plus aggregator hosts such as aihubmix.com and jiekou.ai. These are the destinations the extension's own description promises.
No postinstall script findings, no child_process execution findings, no filesystem findings, and no manifest-analysis hits. No malware signatures matched and no tool-poisoning indicators did either.
Credential access
Zero secret findings. For an add-on whose entire function is forwarding your prompts to a model using an API key you supply, that is the number that matters. Nothing shows reads of .env, .git/config, SSH keys, or cloud credential files. Even the secret-storage access we would expect for stashing an API token produced no finding.
The counterargument, and why it fails
The strongest case against this call is the endpoint list itself. A bring-your-own-key extension sits between your code and a third party, and two names in that list, 2-d.top and ci.show, do not map to any known provider. If a bundled relay were forwarding requests, it would see your key and your prompts.
That case collapses once you read the list as a whole. It also contains document.documentelement.clientheight-s.top, which is a minified property access chain (document.documentElement.clientHeight, a subtraction, then .top), along with editingmodel.vision, fetchedmodel.vision, and filled.vision, all string-concatenation artifacts. ci.show has the same shape, because .show is a DOM method. The extractor is splitting minified extension/out/extension.js on dots and treating the pieces as domains. Of the 598 total findings, 515 are IoC entries produced exactly this way.
The 79 code-smell findings are all low severity and land on that same bundled file. Rules matching fetch, exec, fs, process.env, or API-key strings fire on any non-trivial JavaScript, and this file is webpack output for a network client.
Conclusion
Nothing here describes behavior inconsistent with relaying chat requests to model providers, and no finding targets a real credential store.
Key Reasons
- All four network findings (NET-FETCH and NET-SOCKET_IO in extension/out/extension.js) are HTTP and socket calls, which is the extension's stated function of proxying chat requests to model providers.
- The endpoint list resolves to legitimate AI providers (api.openai.com, api.anthropic.com, api.groq.com, api.mistral.ai, api.cerebras.ai) matching the extension description.
- Zero malware-signature, secret, dependency, obfuscation, and tool-poisoning findings; 515 of 598 findings are IoC entries, including property-chain artifacts like ci.show and document.documentelement.clientheight-s.top.
- The 79 code-smell findings are all low severity and land on the single bundled file extension/out/extension.js, typical of minified build output for a network client.
- No postinstall, child_process, or filesystem findings, and no credential files such as .env or .git/config appear anywhere in the results.
False Positive Considerations
- IoC extractor splitting minified property access chains into fake domains (ci.show, document.documentelement.clientheight-s.top, filled.vision).
- Low-severity code-smell rules matching bundled webpack output in extension/out/extension.js.
- Finding count inflated by 515 IoC entries from a single bundled file.
- String-concatenation fragments with .top and .vision suffixes read as top-level domains.
Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 82%.
Open VSX version history
Risk trend by version
11 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace