Find the editor plugins that reach out, run code or read your keys.
Sargha lists every plugin in your editors on each machine, records what the plugin's own code does, scores it, and leaves the decision with your security team.
What the sensor records, as facts
- RecordedEach plugin's editor, publisher, ID, version, install folder and SHA-256 of its package file.
- RecordedHosts its code names, as domain names or IP addresses, with the file and line each one came from. Up to 25 locations per host.
- RecordedCredential files it refers to (for example cloud or SSH key files), with the file and line. Token environment variables are described in words, not copied.
- RecordedCode that downloads and runs something, or builds code at run time, with the file and line.
- RecordedInstall scripts, shell or process commands it starts, and obfuscation markers, each with the file and line.
Severity you can check by hand
Severity is a sum of named factors with fixed points. Each factor shows its points, why it applies and where it was found. Bands run from low to critical, and the total is capped at 100.
What to block now
For each plugin: the hosts and IP addresses to block at DNS and egress, the credential paths and plugin folder to watch, the file hash, and the commands and searches to run now.
Your own known-bad list
Match plugins against your own list of hashes, host names and publishers. A plugin whose name closely imitates a popular plugin is flagged, and so is one that reads credentials and also reaches the network.
Decisions are recorded
Every alert, quarantine or block records the reason, who decided and when, in the audit trail.
Quarantine and block are opt-in
Alerts are on from low risk. Quarantine and block are off until your security team sets them for each severity, and they act only on a sensor set to enforce.
Reversible
Quarantine moves the plugin folder out of the editor, keeps it, and can restore it. It acts only on the exact files that were reported; a folder changed since the report is left alone.
What it does not do
- Not doneIt does not run plugin code. The analysis reads files only, so there is no sandbox run and no dynamic behaviour.
- Not doneIt does not watch the traffic a plugin actually sends. It knows the hosts named in the code, not the connections made.
- Not doneIt does not block a plugin being reinstalled. Blocking a reinstall needs a policy in the editor, which the sensor does not write, so a removed plugin can come back until that policy exists.
- LimitsIt reads plugin files up to 1 MB each, at most 300 files per plugin and four folder levels deep. Anything beyond those limits is not read.
- Never sentThe record never includes file contents or secret values. Hosts appear as they are written in the code, and install-script commands appear as written in package.json.
- Sensors on the machines whose editors you want covered.
- Your security team sets alert, quarantine and block levels. Until they do, plugins are only recorded and alerted.
- Optional: your own list of known-bad hashes, host names and publishers.
How the sensor reads the plugin folders, and when it runs
Request the demo and technical packSee the AI on your fleet in about a week.
Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.