Skip to main content
Package Firewall blocks malicious VS Code extensions before they install. It checks every extension your developers install from the Microsoft Marketplace against your policy, and any extension that does not meet it is never offered for installation. You deploy the VS Code script to your developer machines through an MDM tool such as Microsoft Intune, Jamf, or Kandji. View blocked and warned events for VS Code extensions in the Package Firewall logs, filtered by the VS Code ecosystem. See View Package Firewall logs to learn more.

​
How it works

After you deploy the VS Code script to your developer machines, Package Firewall handles extension installation requests as follows:
1

Point VS Code at Package Firewall

The VS Code script sets the extensionsGallery.serviceUrl in VS Code’s product.json to your Package Firewall URL, so VS Code requests extensions from Package Firewall instead of the Microsoft Marketplace.
2

Filter extension requests

Package Firewall checks each requested extension against your policy and returns only the versions that meet it. A version that does not meet the policy is never offered for installation.
VS Code rewrites product.json on every update, so a manually applied gallery URL is reverted. Deploy the script through an MDM tool, which re-applies the setting automatically after each VS Code update.

​
Before you begin

Create an API key dedicated to the Package Firewall so that can authenticate to it. You can create it through one of the following methods:
  • Using the Endor Labs user interface, with the Package Firewall User role. See API keys to learn more.
  • Using endorctl, with the SYSTEM_ROLE_PACKAGE_FIREWALL role. Make sure to install and configure endorctl before you create the key.
To create the key using endorctl, run the following command and replace:
  • <namespace> with your namespace.
  • <API key name> with the name of the API key for the Package Firewall use case.
  • <YYYY-MM-DDTHH:MM:SSZ> with the API key expiration in ISO 8601 UTC format, for example 2026-12-31T23:59:59Z.

​
Set up the deployment script

Generate the VS Code script, then push it to your developer machines with your MDM tool. See MDM deployment for the upload steps.

​
Policy

A Package Firewall policy for VS Code extensions supports the malware and minimum package age conditions. When an extension version matches a condition, Package Firewall curates it out of the Microsoft Marketplace results so it is not offered for installation, rather than returning a block as it does for other ecosystems. To always allow a specific extension, add an exception using the extension’s identifier in publisher.name form, such as ms-python.python. This identifier appears as the unique identifier on the extension’s Marketplace page, and in the extension’s details in VS Code. You can allow all versions of the extension, a specific version, or a range of versions. See Package Firewall policy to learn more.

​
Limitations

Keep the following limitations in mind when using Package Firewall for VS Code extensions:
  • Package Firewall covers only the extensions available in the Microsoft Marketplace, the default for official Microsoft builds of VS Code. It does not cover the Open VSX registry, which is the default for VSCodium and Cursor.
  • Extensions installed from a downloaded .vsix file do not go through the Marketplace, so Package Firewall cannot filter them. Disable file-based installation with a VS Code enterprise policy to close this gap.
  • For an extension that publishes thousands of versions, Package Firewall may not check the oldest ones. If every version it checks is blocked, the extension cannot be installed.