Manifest
    by Manifold
    Back to Results
    0.5.5

    vscode-proto3

    Protobuf 3 support for Visual Studio Code

    Programming LanguagesSnippets
    Rank#-4295
    Publisher zxh404Registry openvsx156,392Last scanned Sep 7, 2026, 11:22 PMRegistryHomepageGitHub
    Created
    10 years ago
    Last commit
    10 months ago
    Latest release
    v0.5.710 months ago

    Security Findings

    19

    Hardcoded C2 with exfil/exec behavior

    MaliciousScanner

    Contacts a hardcoded public IP paired with download/eval/sensitive-access/upload

    OWASP-AST01

    Hardcoded C2 infrastructure7×

    SuspiciousScanner

    Hardcoded public IP address: 171.16.0.5

    Hardcoded public IP address: 172.15.0.5

    Hardcoded public IP address: 172.32.0.5

    Hardcoded public IP address: 168.254.2.3

    Hardcoded public IP address: 12.1.2.3

    Hardcoded public IP address: 165.225.132.33

    Hardcoded public IP address: 192.162.1.2

    OWASP-AST01

    Hardcoded secrets/API keys

    SuspiciousScanner

    Basic Auth Credentials: p%40s...****

    node_modules/npm/node_modules/hosted-git-info/index.js

    OWASP-AST04

    Sensitive file access

    SuspiciousScanner

    Access to sensitive file: /etc/passwd

    OWASP-AST03

    Suspicious outbound hosts9×

    SuspiciousScanner

    Outbound URLs to non-allowlisted host(s): blog.caustik.com, blog.izs.me, docs.amazonwebservices.com, fengmk2.com, flipjs.io, goo.gl, juliangruber.com, ponyfill.com

    Outbound URLs to non-allowlisted host(s): blog.axqd.net, blog.izs.me, codecov.io, debuggable.com, dominictarr.com, dustindiaz.com, ecma-international.org, es5.github.io

    Outbound URLs to non-allowlisted host(s): blog.izs.me, ci.appveyor.com, debuggable.com, hughsk.io, jmrware.com, json-schema.org, mathiasbynens.be, stackoverflow.com

    Outbound URLs to non-allowlisted host(s): bit.ly, isaacs.couchone.com, n8.io, npm.community, www.gatsbyjs.org

    Outbound URLs to non-allowlisted host(s): badge.fury.io, blah.net, blog.izs.me, deadhorse.me, encoding.spec.whatwg.org, flipjs.io, hackerone.com, hughsk.io

    Outbound URLs to non-allowlisted host(s): allyoucanleet.com, aspn.activestate.com, blog.izs.me, code.activestate.com, crbug.com, d10.github.io, dev.chromium.org, dojofoundation.org

    Outbound URLs to non-allowlisted host(s): blogs.msdn.com, crbug.com, foo.bar, frankensteinjs.org, goo.gl, lynx.invisible-island.net, public.kitware.com, some.custom.location

    Outbound URLs to non-allowlisted host(s): blog.izs.me, bugs.chromium.org, dev.twitter.com, feross.org, go.npm.me, izs.me, ljharb.codes, re-becca.org

    Outbound URLs to non-allowlisted host(s): badassjs.com, genius.com, gulpjs.com, h3manth.com, i.am.charlike.online, kolarik.sk, mochajs.org, mrmlnc.com

    OWASP-AST01