Manifest
    by Manifold
    Back to Results
    0.64.7

    Power User for dbt

    a.k.a. dbt power user makes vscode work seamlessly with dbt™ core and dbt™ cloud: auto-complete, preview, column lineage, AI docs generation, health checks, cost estimation etc

    OtherProgramming LanguagesSnippetsData ScienceFormattersTesting
    Rank#111
    Publisher innoverioRegistry openvsx333,816Last scanned Sep 30, 2026, 02:48 PMRegistryHomepageGitHub
    Created
    6 years ago
    Last commit
    2 weeks ago
    Latest release
    0.64.62 weeks ago

    Security Findings

    8

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in webview_panels/dist/assets/index.js: fetch(

    webview_panels/dist/assets/index.js

    OWASP-AST06

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in webview_panels/dist/assets/main.js: fetch(

    webview_panels/dist/assets/main.js

    OWASP-AST06

    Hardcoded secrets/API keys2×

    SuspiciousScanner

    Secret Keyword: Show ...****

    Secret Keyword: ****

    webview_panels/dist/assets/main.js

    OWASP-AST04

    Sensitive file access

    SuspiciousScanner

    Access to sensitive file: homedir(),candidates=[],uvToolBinDir=process.env.UV_TOOL_BIN_DIR;uvToolBinDir&&candidates.push(path_1.default.join(uvToo...

    OWASP-AST03

    Dangerous security bypass flags

    SuspiciousScanner

    Bypass flag in content: --trust

    OWASP-AST06

    Transitive delivery to an unrelated extension

    SuspiciousScanner

    Pulls unrelated extension(s) via extensionPack/Dependencies (payload lives in the target): samuelcolvin.jinjahtml, altimateai.vscode-altimate-mcp-server

    OWASP-AST02

    Install-lifecycle script shipped

    SuspiciousScanner

    package.json postinstall script is shipped (inert on VSIX install but a build-hygiene / dev-tooling tell): node postInstall.js

    OWASP-AST02OWASP-AST06