RunVSAgent

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What the package actually contains

The manifest for RunVSAgent declares no permissions and no host permissions, and the Marketplace listing carries an empty description, so the technical case rests on code inside the package. All 100 network findings land in bundled dependencies, chiefly RunVSAgent/node_modules/@microsoft/1ds-post-js/bundle/ms.post.gbl.min.js and its versioned siblings (ms.post-3.2.18.js, ms.post-3.2.13.gbl.js, ms.post.gbl.js). Those files hold Microsoft's 1DS telemetry poster, the library Microsoft ships for posting usage events. A NET-FETCH hit inside ms.post.gbl.min.js line 6 describes that library calling fetch to send a payload, and the NET-XMLHTTPREQUEST hits at line 2400 of the same family describe its fallback transport. The RunVSAgent/node_modules/@c4312/eventsource-umd/dist/index.d.ts hit points at a type declaration for an EventSource polyfill, packaging metadata rather than runtime behaviour.

Filesystem and process access

No finding in this scan reports a workspace read, a workspace write, or a process spawn. No secret findings came back, and the manifest requests no permissions at all. A coding-agent runner that could not touch the workspace would not work, so the absence of those findings in a package that clearly ships a runtime (RunVSAgent/runtime/extension.js) tells us the scan caught the bundle's network surface and little else.

Credential findings

Zero. The endpoint list's closest thing to an identifier, 764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com, is a public OAuth client ID of the kind that ships in every Google sign-in front end. Entries such as 40gmail.com and 2freadme.md are substrings carved out of longer URLs.

The obfuscation hit

OBFUSCATION-unicode_heavy fires once, on RunVSAgent/runtime/extension.js. That path matches compiled extension output, and the rule keys on dense non-ASCII text, which bundlers and minifiers produce routinely. No malware signature matched anywhere in the package, so the high severity label rests on the character mix of a build artifact.

Counterargument

The strongest case against this verdict: 5,545 IoC entries, 1,715 code-smell hits, and one high-severity obfuscation finding, in a package from a publisher with no verified badge and 30,430 users. Volume like that usually means something. Trace each class back and it shrinks. The IoC entries include 2fgithub.com and 1config.sh, fragments of URL-encoded strings. The code-smell ruleset matches any JavaScript touching crypto or environment variables. The obfuscation hit sits on a bundler artifact. A real implant would show a credential read, an environment scrape, or a domain resolving to somebody's server, and none of those appear here.

Key Reasons

• All 100 network findings sit in bundled dependencies, mainly RunVSAgent/node_modules/@microsoft/1ds-post-js/bundle/ms.post.gbl.min.js, Microsoft's 1DS telemetry poster.
• No malware signature, no secret finding, and no filesystem or process-spawn finding appears in the package.
• OBFUSCATION-unicode_heavy fires only on RunVSAgent/runtime/extension.js, which matches compiled extension bundle output.
• Endpoint entries such as 2freadme.md, 2fgithub.com, and 40gmail.com are URL fragments produced by the extractor, and the Google entry is a public OAuth client ID.
• The manifest declares no permissions and no host permissions, leaving no privileged capability to abuse.

False Positive Considerations

• Bundled Microsoft 1DS telemetry SDK in node_modules generating 100 NET-FETCH and NET-XMLHTTPREQUEST findings
• IoC extractor emitting URL-encoded substrings (2freadme.md, 2fgithub.com, 40gmail.com, 1config.sh) as endpoints
• unicode_heavy obfuscation rule firing on a minified runtime bundle at RunVSAgent/runtime/extension.js
• 1,715 code-smell hits matching generic JavaScript patterns such as crypto and environment variable references

Reviewed 2026-10-15; recommended action: suppress false positive; model confidence 82%.