Manifest
    by Manifold
    Back to Results
    2026.10.70518

    GitLens — Git supercharged

    Supercharge Git within VS Code — Visualize code authorship at a glance via Git blame annotations and CodeLens, seamlessly navigate and explore Git repositories, gain valuable insights via rich visualizations and powerful comparison commands, and so much more

    OtherSCM Providers
    Rank#1195
    Publisher eamodioRegistry openvsx17,446,983Last scanned Oct 7, 2026, 06:13 PMRegistryHomepageGitHub
    Created
    10 years ago
    Last commit
    7 days ago
    Latest release
    v19.3.07 days ago

    Security Findings

    7

    Package registry name mismatch

    SuspiciousLineage

    npm name 'gitlens' != repo 'vscode-gitlens'

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in dist/browser/gitlens.js: fetch(

    dist/browser/gitlens.js

    OWASP-AST06

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in dist/integrations.js: fetch(

    dist/integrations.js

    OWASP-AST06

    Hardcoded secrets/API keys

    SuspiciousScanner

    Secret Keyword: Hide ...****

    dist/webviews/shared.js

    OWASP-AST04

    Sensitive file access

    SuspiciousScanner

    Access to sensitive file: ~/.ssh

    OWASP-AST03

    Unpinned dependencies

    SuspiciousLineage

    28 unpinned: @awesome.me/webawesome, @gitkraken/commit-graph, @gitkraken/commit-graph-ui, @gitkraken/provider-apis, @gitlens/agents

    Workflow makes outbound network call

    SuspiciousLineage

    [.github/workflows/ci.yml] curl -fsSL "https://windsurf-stable.codeium.com/api/update/linux-x64/stable/latest