Documentation
¶
Overview ¶
Package vsix extracts npm packages embedded inside VS Code extension (.vsix) files.
A .vsix file is a ZIP archive. Inside it, the extension's own manifest lives at extension/package.json, and any bundled npm dependencies live under extension/node_modules/. By reading every package.json found inside a node_modules/ directory within the archive we surface the full transitive dependency tree of the extension and connect it to the OSV npm vulnerability feed.
The .vsix file path is used as the Descriptor in PackageLocation so that security tooling can attribute a vulnerable npm package directly back to the distributable archive that contains it — critical for artifact-registry scanning workflows where extensions are never unpacked on the scanning host.
Index ¶
Constants ¶
const (
// Name is the unique name of this extractor.
Name = "javascript/vsix"
)
Variables ¶
This section is empty.
Functions ¶
func New ¶
func New(cfg *cpb.PluginConfig) (filesystem.Extractor, error)
New returns a new Extractor initialised from cfg.
Types ¶
type Extractor ¶
type Extractor struct {
// Stats is the metric collector. Set by the framework after construction.
Stats stats.Collector
// contains filtered or unexported fields
}
Extractor extracts npm packages from VS Code extension (.vsix) archive files.
func (*Extractor) Extract ¶
func (e *Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (inventory.Inventory, error)
Extract reads a .vsix archive from input, walks every package.json entry found inside a node_modules/ directory, and returns an Inventory of npm packages for each entry that has both a name and a version.
Errors from individual package.json entries (bad JSON, missing fields, I/O) are logged and skipped so that a single corrupt entry does not abort the entire archive scan. An error is returned only when the archive itself cannot be opened or read.
func (*Extractor) FileRequired ¶
func (e *Extractor) FileRequired(api filesystem.FileAPI) bool
FileRequired returns true for regular files whose path ends with ".vsix" (case-insensitive) and whose size does not exceed the configured limit.
func (*Extractor) Requirements ¶
func (e *Extractor) Requirements() *plugin.Capabilities
Requirements returns the plugin capabilities required by this extractor. The VSIX extractor only needs local file access — no network or elevated privileges are required.
Source Files