With an ever-growing list of malicious plugins, vscode rightly requires its type, similar to sublime and others. I'm proposing to use vsix as the type to represent the file extension used by these extensions since the same extension can be installed locally as well as via marketplaces such as Visual Studio and open-vsx.

Eg:

https://marketplace.visualstudio.com/items?itemName=ms-python.python

pkg:vsix/[email protected]
pkg:vsix/[email protected]?download_url=https%3A%2F%2Fmarketplace.visualstudio.com%2F_apis%2Fpublic%2Fgallery%2Fpublishers%2Fms-python%2Fvsextensions%2Fpython%2F2023.25.10292213%2Fvspackage

vscode extensions installed from open-vsx

Eg: https://open-vsx.org/extension/muhammad-sammy/csharp

pkg:vsix/muhammad-sammy/[email protected]?download_url=https%3A%2F%2Fgithub.com%2Fmuhammadsammy%2Ffree-vscode-csharp%2Freleases%2Fdownload%2F2.15.30%2Fcsharp-platform-neutral-2.15.30.vsix

Related:

• osquery 5.11.0 supports collecting vscode extensions