How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff like this get out of hand quickly!

I can only think that strong application whitelisting would control this, or have a security policy for these application extras. (Is there a proper term for that instead of using application extras?)

I'm having trouble finding what Microsoft's stance is for PowerShell modules and the Code Marketplace? How are they making sure that those extras aren't malicious? How is any business making sure those extras aren't malicious?

closed as too broad by forest, Matthew, Xander, Teun Vink, LvB Jan 6 at 12:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


The safest way is to vet it yourself by reading the source code before installing and the changes before each update. You can find guides to read each browser's extensions/addons source code here:

As for Visual Studio, you can choose only the extensions which are open source and read their linked repository from their marketplace page.

Regarding security policies, I believe most big companies have a policy for vetting each extension being installed in any service. You'll need an application or infrastructure security team for that.

Not the answer you're looking for? Browse other questions tagged or ask your own question.