An email when an extension your team uses changes hands

Paste your team's extension list once. When one of them gets a new publisher, asks for new permissions or site access, or is pulled from its store, you get an email that day, before your laptops update it. VS Code Marketplace, Open VSX (Cursor, Windsurf, VSCodium) and the Chrome Web Store.

57publisher or developer changes

387Chrome extensions that gained permissions or site access

21VS Code and Open VSX extensions pulled from their store

Recorded by our daily history of the top 5,000 VS Code, top 5,500 Open VSX and all ~389,000 Chrome Web Store extensions, 5 Oct to 2 Nov 2026. Chrome developer details are re-read for extensions with 10,000+ users, for any that ship a new version, and daily for every extension on a team's list.

Sample email, a real change from our history · Subject: extcheck: 2 changes in your team's extensions (review)

2 changes to extensions on your list since the last email:

- 2026-10-31  ibm.taz-edt-extension (Open VSX): publishing account changed from AmonIBM to sgibm
- 2026-10-31  ibm.taz-edt-extension (Open VSX): new version 3.1.1 within 30 days of the change on 2026-10-24: review before it updates

A new publisher, new permissions or a removal doesn't always mean something is wrong, but it is the moment to look:
check the extension's page and changelog before your machines update it.

Your watch page (keep this link private): https://opsfixes.com/extcheck/watch/#…
Watching 41 extensions; all found.

Most changes are harmless: a company renames its account, a new maintainer takes over. The email is for the few that aren't, like the compromised Nx Console release in May 2026, which was live for 18 minutes.

The changes that matter, nothing else

New publisher, developer or email; new permissions, host access, content-script sites or external messaging; removed, unpublished or flagged; verification lost; and the first new version after any of those. Plain version bumps don't email you.

History from day one

Your watch page shows what changed on each listed extension since 5 October 2026. A script or a prompt can check a listing today; it can't tell you who published it last month.

One list for the team, three stores

VS Code, Cursor and Windsurf (Open VSX) and Chrome together, up to 300 extensions. No agent on laptops, no admin access to anything.

$49 a month per team, up to 300 extensions

Includes sales tax or VAT. Monthly, cancel any time. 14-day refund, no questions (refund policy).

No extension IDs found in that list. Use IDs like ms-python.python or Chrome Web Store links.

Checkout and invoices by Creem, our merchant of record. Alerts go to the email you pay with. Your private watch page link appears right after payment and in every email.

How it compares

	extcheck Team	Built into the editor or browser	Enterprise extension security
Tells you a publisher changed	Yes, by email	No	Yes
Tells you about new permissions or site access	Yes (Chrome)	Chrome asks each user, for permissions that show a warning	Yes
Delays updates	No: use VS Code's own `extensions.autoUpdateDelay` (12 h by default)	VS Code yes; Chrome no	Some
Blocks extensions	No: use `extensions.allowed` or Chrome policies	Yes, allow-lists	Yes
History before you signed up	Since 5 Oct 2026	No	Yes
Price	$49 a month per team	Included	Sales call; Socket lists extension scanning on its Enterprise plan only

From the VS Code documentation and Socket's pricing page, read 2 November 2026. Products change; check them yourself.

How it works

Paste your list above and pay. Your private watch page opens right away with the list; the first report from our history arrives within a few hours, with a welcome email that has the link.
Our collector reads every store once a day and records what changed. When something on your list changes, you get an email, usually within 24 hours of the change reaching the store.
Every week without an alert, a short "no changes" note, so you know it's running.

Extensions outside the top lists are added to the daily collection the day you list them; their history starts then.

What it doesn't do

It doesn't scan extension code for malware, and a quiet week doesn't mean an extension is safe.
It doesn't install, block or update anything, and it can't see what's installed on each laptop: it watches the list you give it.
It isn't real time: the stores are read once a day.

Questions

What data do you keep?

Your list of extension IDs and the reports about them. Your name and email stay with Creem, our merchant of record; we look the email up when we send an alert.

Is the one-off check still free?

Yes: the extcheck GitHub Action and editor extension check a list once, for free. Team adds the history and the emails.

Can I use it for several teams?

One subscription is one list and one email address. For more lists, start another subscription, or email support@opsfixes.com.

Who makes it?

Hieu Tran, with AI agents. It's an early product: if something is wrong or missing, email support@opsfixes.com and it gets fixed.