3.9.0

    Excalidraw

    Draw schemas in VS Code using Excalidraw

    Rank#606
    Publisher pomdtrRegistry openvsx176,415Last scanned Sep 14, 2026, 08:49 AMRegistryHomepageGitHub

    Security Findings

    6

    Publisher cannot be tied to the declared repo

    SuspiciousLineage

    The declared source repository could not be tied to this publisher: the registry namespace does not match the repo owner, the namespace is not verified, and no Marketplace twin corroborates it. Repo lineage is not shown, because it would describe a repository this publisher may not own.

    Dynamic exec of remote content (VSX)

    SuspiciousScanner

    Fetched content reaches a dynamic exec sink in webview/dist/assets/katex-CfZphoad.js: fetch(

    webview/dist/assets/katex-CfZphoad.js

    Hardcoded secrets/API keys

    SuspiciousScanner

    Secret Keyword: AIzaS...****

    webview/dist/assets/index-DqiYdVlf.js

    Dangerous security bypass flags

    SuspiciousScanner

    Bypass flag in content: --trust

    Unpinned dependencies

    SuspiciousLineage

    1 unpinned: @vscode/test-web

    Install-lifecycle script shipped

    SuspiciousScanner

    package.json install script is shipped (inert on VSIX install but a build-hygiene / dev-tooling tell): cd webview && npm install