Immutable Deep Scan reportEvidence is locked to this exact artifact and scan.
About immutable reports
Future scans cannot replace the findings, coverage, ruleset, or artifact hash shown on this URL.
- Scan
8b9f414d-e5cc-4881-aa9f-e4bc2d00f906- Artifact
43fd50e5bba1…c90337db
Analysis Report
Jupyter
ms-toolsai.jupyter@2026.6.2026071501Completed analysis for this exact extension version. Use the summary below to decide what your team should do next.
Prevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.
- Required action
- Do not install this version
This exact artifact should not be installed.
Inspect the evidence that supports this do-not-install policy decision.
Prevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.
This result applies only to the scanned artifact SHA-256, not to future releases or a publisher generally.
Do not install this exact artifact. Record an exception only with accountable approval.
Required analysis completed for this exact artifact; evidence remains scoped to scanner coverage.
- 1Artifact boundExtension, version, hash, and scan identity fixed
- 2Analysis checkedExecutable-file coverage
- 3Evidence grouped2 actionable · 17 contextual
- 4Policy appliedExact-release ruleset evaluated
- 5Do not installCurrent decision for this artifact
96/100Do not install
Diagnostic risk index for this exact artifact — not a probability of malice.
Policy result for this exact artifact
100
7/7 required analyzers completed
0
Diagnostic index, not probability
17 contextual notes kept separate
Power describes access, not intent
2 evidence groups support this do-not-install decision.
Prevent execution pending review: high-confidence abuse-chain evidence matched (remote-vsix-install-chain). This is a preventive policy decision, not a confirmed-malicious label.
43fd50e5bba11c575bfd6bab5a922015b3272a2d61b317788c8002d2c90337dbBuild ebc6ba89193a · ruleset 2026.08.21-obfuscated-bundle.1
Evidence supporting this decision
Code downloads a VSIX, writes it locally, and invokes the IDE extension installer without visible integrity verification.
1 observed location · review evidence
Native binary dist/node_modules/zeromq/prebuilds/win32-arm64/node.napi.glibc.node has no companion checksum or signature file and no documented provenance.
1 observed location · review evidence