I was wondering if there was room for improvement for the extension. I am forced to run a VSX report on every extension before downloading. This is the report VSX produces for prettier. I was wondering if there was room for improvement. I am not sure how critical it is.
I saw some version bumps for minimatch and lodash. Those two had security problems so those PRs should be merged.
vsix-audit scan esbenp.prettier-vscode
Downloading: esbenp.prettier-vscode
✓ Downloaded ~/.cache/vsix-audit/marketplace/esbenp.prettier-vscode-12.4.0.vsix
vsix-audit scan results
──────────────────────────────────────────────────
Extension: Prettier - Code formatter v12.4.0
Publisher: esbenp
Scanned: 2026-05-22T10:08:40.736Z
Checks performed:
⚠ YARA Skipped (yara not installed)
✓ Package Blocklist, manifest analysis, npm dependencies, lifecycle scripts
✓ Obfuscation Entropy and Unicode analysis across 80 files
✓ AST Structural code analysis across 56 code files
✓ IOC Hashes, domains, IPs against threat intel
✓ Telemetry Analytics and data collection detection
Found 2 issue(s):
[MEDIUM] Extension activates on startup
Extension uses "onStartupFinished" activation event. Common in extensions that need to initialize early (git integration, status bar items, language servers). Review if early activation is necessary for the extension's purpose.
at package.json
[MEDIUM] Dynamic import() with non-literal source
import() is called with a variable or expression. This can load arbitrary modules at runtime.
at dist/extension.js:2293
With Yara-X it might be producing false positives for regex matching.
Found 46 issue(s):
[CRITICAL] YARA rule match: LOADER_JS_Download_Write_Execute_Jan25
YARA rule "LOADER_JS_Download_Write_Execute_Jan25" from multi_stage_attacks.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/internal/experimental-cli-worker.mjs
[CRITICAL] YARA rule match: LOADER_JS_Download_Write_Execute_Jan25
YARA rule "LOADER_JS_Download_Write_Execute_Jan25" from multi_stage_attacks.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/internal/experimental-cli.mjs
[CRITICAL] YARA rule match: MAL_JS_GlassWorm_Extension_Modification_Jan25
YARA rule "MAL_JS_GlassWorm_Extension_Modification_Jan25" from multi_stage_attacks.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/internal/experimental-cli.mjs
[CRITICAL] YARA rule match: STEALER_JS_Credential_File_Exfil_Jan25
YARA rule "STEALER_JS_Credential_File_Exfil_Jan25" from data_exfiltration.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/internal/experimental-cli-worker.mjs
[CRITICAL] YARA rule match: STEALER_JS_Credential_File_Exfil_Jan25
YARA rule "STEALER_JS_Credential_File_Exfil_Jan25" from data_exfiltration.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/internal/experimental-cli.mjs
[CRITICAL] YARA rule match: SUSP_JS_Eval_Base64_Jan25
YARA rule "SUSP_JS_Eval_Base64_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
[CRITICAL] YARA rule match: SUSP_JS_Eval_Charcode_Jan25
YARA rule "SUSP_JS_Eval_Charcode_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
[CRITICAL] YARA rule match: SUSP_JS_Obfuscation_Eval_Jan25
YARA rule "SUSP_JS_Obfuscation_Eval_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
[HIGH] YARA rule match: SUSP_JS_Function_Constructor_Jan25
YARA rule "SUSP_JS_Function_Constructor_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/bin/prettier.cjs
[MEDIUM] Extension activates on startup
Extension uses "onStartupFinished" activation event. Common in extensions that need to initialize early (git integration, status bar items, language servers). Review if early activation is necessary for the extension's purpose.
at package.json
[MEDIUM] Dynamic import() with non-literal source
import() is called with a variable or expression. This can load arbitrary modules at runtime.
at dist/extension.js:2293
[MEDIUM] YARA rule match: SUSP_JS_Child_Process_Variable_Jan25
YARA rule "SUSP_JS_Child_Process_Variable_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/extension.js
[MEDIUM] YARA rule match: SUSP_JS_Child_Process_Variable_Jan25
YARA rule "SUSP_JS_Child_Process_Variable_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/typescript.mjs
[MEDIUM] YARA rule match: SUSP_JS_Child_Process_Variable_Jan25
YARA rule "SUSP_JS_Child_Process_Variable_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/typescript.js
[MEDIUM] YARA rule match: SUSP_JS_Child_Process_Variable_Jan25
YARA rule "SUSP_JS_Child_Process_Variable_Jan25" from code_execution.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/acorn.js
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/glimmer.js
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/glimmer.mjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/acorn.mjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/babel.mjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/meriyah.js
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/meriyah.mjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/babel.js
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/flow.mjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web/test/suite/index.cjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/typescript.mjs
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/typescript.js
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/flow.js
[MEDIUM] YARA rule match: SUSP_JS_Decimal_Byte_Array_Jan25
YARA rule "SUSP_JS_Decimal_Byte_Array_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/standalone.js
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/standalone.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/acorn.js
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/acorn.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/babel.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/estree.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/estree.js
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/babel.js
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/index.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/internal/experimental-cli.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/flow.mjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web/test/suite/index.cjs
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/flow.js
[MEDIUM] YARA rule match: SUSP_JS_Hex_Escape_Chain_Jan25
YARA rule "SUSP_JS_Hex_Escape_Chain_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
[MEDIUM] YARA rule match: SUSP_JS_String_Array_Rotation_Jan25
YARA rule "SUSP_JS_String_Array_Rotation_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/typescript.mjs
[MEDIUM] YARA rule match: SUSP_JS_String_Array_Rotation_Jan25
YARA rule "SUSP_JS_String_Array_Rotation_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at node_modules/prettier/plugins/typescript.js
[MEDIUM] YARA rule match: SUSP_JS_String_Array_Rotation_Jan25
YARA rule "SUSP_JS_String_Array_Rotation_Jan25" from obfuscation_patterns.yar matched this file. This indicates the file contains patterns associated with known malware or suspicious behavior.
at dist/web-extension.cjs
I was wondering if there was room for improvement for the extension. I am forced to run a VSX report on every extension before downloading. This is the report VSX produces for prettier. I was wondering if there was room for improvement. I am not sure how critical it is.
I saw some version bumps for minimatch and lodash. Those two had security problems so those PRs should be merged.
With Yara-X it might be producing false positives for regex matching.