Skip to main content
Package Firewall blocks malicious VS Code extensions before they install. It checks every extension your developers install from the Microsoft Marketplace against your policy, and any extension that does not meet it is never offered for installation. Deploy the VS Code script through an MDM tool such as Microsoft Intune, Jamf, or Kandji. On macOS, review the signing changes and user prompts before enabling the daemon. View blocked and warned events for VS Code extensions in the Package Firewall logs, filtered by the VS Code ecosystem. See View Package Firewall logs to learn more.

​
How it works

After you deploy the VS Code script to your developer machines, Package Firewall handles extension installation requests as follows:
1

Point VS Code at Package Firewall

The VS Code script sets the extensionsGallery.serviceUrl in VS Code’s product.json to your Package Firewall URL. Thereafter, VS Code requests extensions from Package Firewall instead of the Microsoft Marketplace.
2

Filter extension requests

Package Firewall checks each requested extension against your policy and returns only the versions that meet it. A version that does not meet the policy is never offered for installation.
VS Code rewrites product.json on every update and reverts a manually applied gallery URL. Deploy the script through an MDM tool, which re-applies the setting automatically after each VS Code update.

​
Before you begin

Create an API key dedicated to the Package Firewall so that the deployment scripts can authenticate to it. You can create it through one of the following methods:
  • Using the Endor Labs user interface, with the Package Firewall User role. See API keys to learn more.
  • Using endorctl, with the SYSTEM_ROLE_PACKAGE_FIREWALL role. Make sure to install and configure endorctl before you create the key.
To create the key using endorctl, run the following command and replace:
  • <namespace> with your namespace.
  • <API key name> with the name of the API key for the Package Firewall use case.
  • <YYYY-MM-DDTHH:MM:SSZ> with the API key expiration in ISO 8601 UTC format, for example 2026-12-31T23:59:59Z.

​
Set up the deployment script

Generate the VS Code script, then push it to your developer machines with your MDM tool. See MDM deployment for the upload steps.
If you use Endor Labs with an EU tenant, select the EU region in the generator so the script uses https://factory.eu.endorlabs.com.

​
Enable VS Code on macOS

On macOS, the VS Code script and endor-all.sh leave VS Code unchanged by default. They print a message that explains how to enable the firewall. Linux and Windows are not affected. To enable it in the browser generator, select Enable VS Code firewall on macOS before you download the script. For local generation, set ENDOR_VSCODE_MACOS_DAEMON=1:
The script installs a root launch daemon for Microsoft VS Code Stable at /Applications/Visual Studio Code.app. Restart VS Code after initial deployment if it is open. The daemon checks a copy of VS Code in a directory that only root can access. It patches and signs that copy with a certificate unique to the Mac, then swaps it into /Applications. This avoids breaking the installed app’s signature by editing it in place. The signing key stays in the System keychain, and you cannot export it. When VS Code downloads an update, the daemon prepares a patched, signed copy before the updater installs it. If preparation fails, VS Code can install Microsoft’s build, and the daemon handles it afterward. Keep this possible gap in mind when planning enforcement.
Re-signing changes VS Code’s identity. Users receive a keychain password prompt at the first migration and after each update, and privacy permission prompts again at migration. Endpoint security and allowlisting rules that match Microsoft’s signer or Team ID no longer match the re-signed app. Review those rules before deploying.
At the keychain prompt for Code Safe Storage, select Always Allow to let VS Code access saved sign-ins. Denying access hides those sign-ins for that session without deleting them. The re-signed app is no longer notarized by Microsoft. The daemon refuses apps with an unexpected signer or changes beyond its own managed patch. If a daemon from an earlier deployment is still installed, a script generated without the option leaves the daemon running, prints a warning, and exits with code 1. Regenerate with the option enabled to keep the daemon, or deploy endor-remove.sh to remove it.

​
Check the daemon

Run these commands as root to inspect the daemon’s status and recent log entries:
For more information, refer to the macOS code-signing details.

​
Remove the daemon

Deploy endor-remove.sh to restore Microsoft’s original app and remove the signing identity. If no original is available, the script restores the default gallery settings in a copy. A copy signed by the daemon stays re-signed until VS Code’s next update replaces it with Microsoft’s build.

​
Policy

A Package Firewall policy for VS Code extensions supports the malware and minimum package age conditions. Package Firewall removes extension versions that meet a condition from Microsoft Marketplace results. If no version remains, or a developer downloads a version directly, Package Firewall blocks the request. To always allow a specific extension, add an exception using the extension’s identifier in publisher.name form, such as ms-python.python. This identifier appears as the unique identifier on the extension’s Marketplace page, and in the extension’s details in VS Code. You can allow all versions of the extension, a specific version, or a range of versions. See Package Firewall policy to learn more.

​
Limitations

Keep the following limitations in mind when using Package Firewall for VS Code extensions:
  • Package Firewall covers only the extensions available in the Microsoft Marketplace, the default for official Microsoft builds of VS Code. It does not cover the Open VSX registry, which is the default for VSCodium and Cursor.
  • Extensions installed from a downloaded .vsix file do not go through the Marketplace, so Package Firewall cannot filter them. Disable file-based installation with a VS Code enterprise policy to close this gap.
  • For an extension that publishes thousands of versions, Package Firewall may not check the oldest ones. If Package Firewall blocks every version it checks, you cannot install the extension.