Manifest
    by Manifold
    Back to Results
    0.8.1

    Kimi Code

    Official Kimi Code plugin for VS Code

    AIChatProgramming Languages
    Rank#-683
    Publisher moonshot-aiRegistry openvsx494,843Last scanned Sep 19, 2026, 04:56 PMRegistryHomepageGitHub
    Created
    4 months ago
    Last commit
    last week
    Latest release
    @moonshot-ai/kimi-code@2.1.1last week

    Security Findings

    18

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in dist/webview.js: fetch(

    dist/webview.js

    OWASP-AST06

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in dist/extension.js: axios

    dist/extension.js

    OWASP-AST06

    Hardcoded secrets/API keys13×

    SuspiciousScanner

    Secret Keyword: API_K...****

    Secret Keyword: x-goo...****

    Secret Keyword: GEMIN...****

    Secret Keyword: workl...****

    Secret Keyword: funct...****

    Secret Keyword: oauth...****

    Secret Keyword: KIMI_...****

    Secret Keyword: OPENA...****

    Secret Keyword: ANTHR...****

    Secret Keyword: GOOGL...****

    Secret Keyword: VERTE...****

    Secret Keyword: strin...****

    Secret Keyword: Clien...****

    dist/extension.js

    OWASP-AST04

    Hardcoded secrets/API keys

    SuspiciousScanner

    Secret Keyword: ****

    dist/webview.js

    OWASP-AST04

    Dangerous security bypass flags

    SuspiciousScanner

    Bypass flag in content: --trust

    OWASP-AST06

    Workflow makes outbound network call

    SuspiciousLineage

    [.github/workflows/vscode-publish.yml] curl -fsS -o /dev/null "https://open-vsx.org/api/moonshot-ai/kimi-code/${target}/${version}