
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
vsix-downloader
Advanced tools
A CLI tool to download VS Code extensions as VSIX files from the Visual Studio Marketplace
A modern CLI tool to download VS Code extensions as VSIX files directly from the Visual Studio Marketplace. Supports both single extension downloads and bulk downloads from JSON configuration files.
Recently, Microsoft quietly blocked Cursor (an AI-powered VSCode fork) from accessing the VSCode extension marketplace by adding a simple environment check. This means Cursor users can no longer install extensions directly through the marketplace, seeing "This extension is not available in your environment" errors.
VSIX Downloader provides a workaround by downloading extensions as .vsix
files that can be manually installed in Cursor. This is particularly valuable for:
--file
to run bulk downloads without prompts--retry
/--retry-delay
options--summary <path>.json
./downloads
in current directory){name}
, {version}
, {source}
, {publisher}
)latest
for both Marketplace and OpenVSX (single and bulk)npm install -g vsix-downloader
npm install vsix-downloader
Simply run the command and choose your download mode:
vsix-downloader
You'll be prompted to choose between:
Or use the download command directly:
vsix-downloader download
Follow the prompts to enter:
latest
)./downloads
)You can also provide arguments directly for single downloads:
# Download with URL and version
vsix-downloader download --url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" --version "2023.20.0"
# Resolve and download the latest version (stable by default)
vsix-downloader download --url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" --version latest
# Prefer pre-release when resolving 'latest'
vsix-downloader download --url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" --version latest --pre-release
# Specify custom output directory
vsix-downloader download --url "..." --version "1.2.3" --output "./my-extensions"
For downloading multiple extensions, create a JSON file with the extension details and use bulk mode.
./downloads
)Create a JSON file (e.g., extensions.json
) with the following structure (mixed sources allowed):
[
{
"url": "https://marketplace.visualstudio.com/items?itemName=ms-python.python",
"version": "latest"
},
{ "url": "https://open-vsx.org/extension/ms-python/python", "version": "2025.4.0" },
{
"url": "https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode",
"version": "latest",
"source": "marketplace"
}
]
url
: Extension URL from either Marketplace or OpenVSXversion
: Specific version to download (or latest
)source
โ marketplace
| open-vsx
(overrides auto-detection)The extension name is automatically extracted from the URL for display purposes in the CLI.
The CLI performs comprehensive validation on your JSON file before starting downloads:
โ File Validation:
โ Extension Validation:
url
field (Marketplace or OpenVSX URL)version
field (non-empty string; latest
allowed)โ Error Handling:
Skip prompts and run bulk download straight from a file. Useful for CI and scripts.
# Basic non-interactive bulk download
vsix-downloader download \
--file ./extensions.json \
--output ./downloads
# Advanced: sequential downloads with retries, backoff, quiet logs and JSON summary
vsix-downloader download \
--file ./extensions.json \
--output ./downloads \
--retry 3 \
--retry-delay 1500 \
--summary ./summary.json \
--quiet
# Bulk download with custom naming and cache directory
vsix-downloader download \
--file ./extensions.json \
--cache-dir ~/.vsix-cache \
--filename-template "{source}/{publisher}-{name}-v{version}.vsix" \
--skip-existing
# Bulk download with progress and checksums
vsix-downloader download \
--file ./extensions.json \
--checksum \
--cache-dir ~/.extensions \
--quiet
# Bulk download with verification against known checksums
vsix-downloader download \
--file ./extensions.json \
--verify-checksum "a1b2c3d4e5f6..." \
--retry 3
Export your currently installed extensions from VS Code or Cursor to share across environments or backup your setup:
# Interactive export - choose editor, format and output
vsix-downloader export-installed
# Export from specific editor
vsix-downloader export-installed --editor cursor -o my-extensions.txt -f txt
vsix-downloader export-installed --editor vscode -o my-extensions.txt -f txt
vsix-downloader export-installed --editor auto -o my-extensions.txt -f txt
# Export to specific file and format (auto-detects editor)
vsix-downloader export-installed -o my-extensions.json -f json
vsix-downloader export-installed -o my-extensions.txt -f txt
vsix-downloader export-installed -o extensions.json -f extensions.json
# Export workspace extensions.json (if it exists)
vsix-downloader export-installed --workspace
# Machine-readable output (no prompts)
vsix-downloader export-installed --json --editor cursor
Export Formats:
json
- Detailed extension info with metadata (name, version, publisher, description)txt
- Simple list of extension IDs (one per line, supports #
comments)extensions.json
- VS Code workspace format (recommendations array)Download extensions from various list formats:
# Interactive mode - select file and proceed
vsix-downloader from-list
# From text file (extension IDs, one per line)
vsix-downloader from-list --file extensions.txt
# From VS Code extensions.json
vsix-downloader from-list --file .vscode/extensions.json
# With all bulk download options
vsix-downloader from-list \
--file extensions.txt \
--output ./downloads \
--parallel 5 \
--retry 3 \
--checksum \
--quiet
Supported Input Formats:
.txt
) - One extension ID per line, #
comments supportedrecommendations
arrayExport extensions from your current setup:
# Export your installed extensions
vsix-downloader export-installed -o my-setup.txt -f txt
Transfer to new environment and download:
# Download all extensions from the list
vsix-downloader from-list --file my-setup.txt --output ./extensions
Install manually in Cursor/VS Code:
# Install all downloaded extensions
cursor --install-extension ./extensions/*.vsix
vsix-downloader download [options] # Download a VSIX file
vsix-downloader versions [options] # List available versions for an extension
vsix-downloader export-installed [options] # Export currently installed extensions
vsix-downloader from-list [options] # Download extensions from a list file
vsix-downloader --help # Show help
vsix-downloader --version # Show version
-u, --url <url>
- Marketplace URL of the extension-v, --version <version>
- Version of the extension to download (or latest
)--pre-release
- Prefer pre-release when resolving latest
--source <source>
- Source registry: marketplace
| open-vsx
| auto
(default: marketplace)
-o, --output <path>
- Output directory (default: ./downloads)-f, --file <path>
- Bulk JSON file path (non-interactive)--parallel <n>
- Number of parallel downloads in bulk mode (default: 4)--retry <n>
- Retry attempts per item in bulk mode (default: 2)--retry-delay <ms>
- Base delay between retries in ms (exponential backoff)--skip-existing
- Skip downloads if target file already exists--overwrite
- Overwrite existing files--filename-template <template>
- Custom filename template (default: {name}-{version}.vsix
)--cache-dir <path>
- Cache directory for downloads (overrides output)--checksum
- Generate SHA256 checksum for downloaded files--verify-checksum <hash>
- Verify downloaded file against provided SHA256 hash--quiet
- Reduce output (suppress interactive notes/spinners)--json
- Machine-readable logs (reserved for future)--summary <path>
- Write bulk summary JSON to the given path-o, --output <path>
- Output file path-f, --format <format>
- Output format: json
| txt
| extensions.json
-e, --editor <editor>
- Editor to export from: vscode
| cursor
| auto
(default: auto)-w, --workspace
- Export workspace extensions.json instead of globally installed extensions--json
- Machine-readable output (no interactive prompts)-f, --file <path>
- Path to extensions list file-o, --output <path>
- Output directory (default: ./downloads)--format <format>
- Input file format: json
| txt
| extensions.json
| auto
-h, --help
- Display help information-V, --version
- Display version numberList all available versions for an extension (Marketplace or OpenVSX). Useful when picking a pinned version or checking pre-releases.
# Prompt for URL, display human-readable list
vsix-downloader versions
# Provide URL and output JSON (works with Marketplace or OpenVSX URLs)
vsix-downloader versions --url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" --json
vsix-downloader versions --url "https://open-vsx.org/extension/ms-python/python" --json
You can download from OpenVSX by specifying the source or by pasting an OpenVSX URL in interactive mode (the source will be preselected as OpenVSX, but you can switch). Bulk supports mixed sources in the same list.
# Single extension from OpenVSX
vsix-downloader download \
--url "https://open-vsx.org/extension/ms-python/python" \
--version latest \
--source open-vsx
# Bulk with OpenVSX
vsix-downloader download \
--file ./extensions.json \
--output ./downloads \
--source open-vsx
Note: auto
source is reserved for future fallback behavior. Currently, set --source
explicitly to marketplace
or open-vsx
.
Customize how downloaded files are named using the --filename-template
option with variable substitution:
# Use a custom filename template
vsix-downloader download \
--url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" \
--version "2023.20.0" \
--filename-template "{publisher}_{name}_v{version}.vsix"
# Results in: ms-python_ms-python.python_v2023.20.0.vsix
# Include source in filename
vsix-downloader download \
--url "..." \
--version "1.2.3" \
--filename-template "{source}-{name}-{version}.vsix"
# Results in: marketplace-publisher.extension-1.2.3.vsix
# Bulk download with custom template
vsix-downloader download \
--file ./extensions.json \
--filename-template "{publisher}/{name}-{version}.vsix"
{name}
- Full extension identifier (e.g., ms-python.python
){version}
- Version number (e.g., 2023.20.0
){source}
- Source registry (marketplace
or open-vsx
){publisher}
- Publisher name (e.g., ms-python
){displayName}
- Display name when available{name}
or {version}
.vsix
extension is automatically added if missing{name}-{version}.vsix
Use a dedicated cache directory for downloads that persists across sessions:
# Use cache directory (overrides --output)
vsix-downloader download \
--url "..." \
--version "1.2.3" \
--cache-dir ~/.vsix-cache
# Skip existing files in cache
vsix-downloader download \
--file ./extensions.json \
--cache-dir ~/.vsix-cache \
--skip-existing
# Bulk download to cache with custom naming
vsix-downloader download \
--file ./extensions.json \
--cache-dir ~/.vsix-cache \
--filename-template "{source}/{publisher}/{name}-{version}.vsix" \
--overwrite
Cache Directory Benefits:
--skip-existing
--output
when both are specifiedMonitor download progress and verify file integrity:
# Generate checksum after download
vsix-downloader download \
--url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" \
--version "2023.20.0" \
--checksum
# Verify downloaded file against known checksum
vsix-downloader download \
--url "..." \
--version "1.2.3" \
--verify-checksum "a1b2c3d4e5f6...your-sha256-hash-here"
# Bulk download with progress and checksums
vsix-downloader download \
--file ./extensions.json \
--checksum \
--cache-dir ~/.extensions
Progress Features:
Checksum Features:
vsix-downloader download --url "https://marketplace.visualstudio.com/items?itemName=ms-python.python" --version "2023.20.0"
# Step 1: Export your current Cursor extensions
$ vsix-downloader export-installed --editor cursor -o my-cursor-extensions.txt -f txt
# Step 2: Review the exported list
$ cat my-cursor-extensions.txt
# ms-python.python
# eamodio.gitlens
# PKief.material-icon-theme
# Continue.continue
# Prisma.prisma
# Step 3: Download all extensions on new machine
$ vsix-downloader from-list --file my-cursor-extensions.txt --output ./downloads
# Step 4: Install in Cursor
$ cursor --install-extension ./downloads/*.vsix
# Step 1: Export your VS Code extensions
$ vsix-downloader export-installed --editor vscode -o vscode-extensions.txt -f txt
# Step 2: Download extensions for Cursor installation
$ vsix-downloader from-list --file vscode-extensions.txt --output ./cursor-migration
# Step 3: Install in Cursor
$ cursor --install-extension ./cursor-migration/*.vsix
# Step 4: Verify Cursor now has the extensions
$ vsix-downloader export-installed --editor cursor --json | grep -c '"id"'
# Export to VS Code workspace format
$ vsix-downloader export-installed -o .vscode/extensions.json -f extensions.json
# Contents of .vscode/extensions.json:
{
"recommendations": [
"ms-python.python",
"eamodio.gitlens",
"PKief.material-icon-theme"
]
}
# Download from workspace extensions.json
$ vsix-downloader from-list --file .vscode/extensions.json --output ./team-extensions
$ vsix-downloader
โ ๐ฝ VSIX Downloader
โ
โ Choose download mode:
โ ๐ฆ Single Extension
โ
โ Enter the VS Code extension marketplace URL:
โ https://marketplace.visualstudio.com/items?itemName=ms-python.python
โ
โ Extension info extracted
โ
โ Extension โโโโโโโโโโโโโโโโโโโโโโโฎ
โ โ
โ ms-python - python โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โ
โ Enter the extension version (or use the version number):
โ latest
โ
โ Enter output directory:
โ ./downloads
โ
โ Download Details โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ โ
โ Filename: ms-python.python-2023.20.0.vsix โ
โ Output: ./downloads โ
โ Resolved Version: 2023.20.0 โ
โ Template: {name}-{version}.vsix โ
โ URL: https://ms-python.gallery.vs...SIXPackage โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โ
โ Download ms-python.python-2023.20.0.vsix?
โ Yes
โ
โ Downloaded successfully!
โ
โ Download Complete โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ โ
โ File: ms-python.python-2023.20.0.vsix โ
โ Location: downloads/ms-python.python-2023.20.0.vsix โ
โ Size: 15420 KB โ
โ SHA256: a1b2c3d4e5f6789... โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โ
โ ๐ Successfully downloaded VSIX extension!
$ vsix-downloader
โ ๐ฝ VSIX Downloader
โ
โ Choose download mode:
โ ๐ Bulk Download
โ
โ Enter the path to your JSON file:
โ ./extensions.json
โ
โ Enter output directory:
โ ./downloads
โ
โ ๐ Reading and validating JSON file...
โ
โ โ
JSON validation passed! Found 3 extension(s) to download.
โ
โ [1/3] ms-python.python - [โโโโโโโโโโโโโโโโโโโโ] 45.2% 15.0 MB/38.4 MB
โ
โ [1/3] โ
ms-python.python (38.4 MB) - SHA256: a1b2c3d4... โ
โ
โ [2/3] esbenp.prettier-vscode - [โโโโโโโโโโโโโโโโโโโโ] 78.9% 218 KB/276 KB
โ
โ [2/3] โ
esbenp.prettier-vscode (276 KB) - SHA256: e5f6g7h8... โ
โ
โ [3/3] PKief.material-icon... - [โโโโโโโโโโโโโโโโโโโโ] 92.1% 738 KB/801 KB
โ
โ [3/3] โ
PKief.material-icon-theme (801 KB) - SHA256: i9j0k1l2... โ
โ
โ Bulk download completed! 3 successful, 0 failed.
โ
โ Download Complete โโโโโโโโโโโโโโโโโโฎ
โ โ
โ Total: 3 extensions โ
โ Successful: 3 โ
โ Failed: 0 โ
โ Output: ./downloads โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โ
โ ๐ Bulk download completed! 3 extension(s) downloaded successfully.
.vsix
you downloaded with this tool (default in ./downloads/
)..vsix
file.cursor --install-extension your-extension.vsix
.vsix
file from your file explorer into the Extensions panel..vsix
file and confirm.--profile "<profile_name>"
to the install command.Export-Import Workflow: The most efficient way to migrate extensions between environments:
# On source machine: export current extensions (auto-detects editor)
vsix-downloader export-installed -o dev-setup.txt -f txt
# Or export from specific editor
vsix-downloader export-installed --editor cursor -o cursor-setup.txt -f txt
vsix-downloader export-installed --editor vscode -o vscode-setup.txt -f txt
# On target machine: download all extensions
vsix-downloader from-list --file dev-setup.txt --cache-dir ~/.extensions
# Install all at once (Cursor or VS Code)
cursor --install-extension ~/.extensions/*.vsix
code --install-extension ~/.extensions/*.vsix
Team Extension Standardization: Use workspace extensions.json for team consistency:
# Create team extension recommendations
vsix-downloader export-installed -o .vscode/extensions.json -f extensions.json
# Team members can download recommended extensions
vsix-downloader from-list --file .vscode/extensions.json
Multiple Environment Support: Maintain different extension sets for different purposes:
# Export different setups from specific editors
vsix-downloader export-installed --editor cursor -o frontend-setup.txt -f txt
vsix-downloader export-installed --editor vscode -o backend-setup.txt -f txt
vsix-downloader export-installed --editor auto -o datascience-setup.txt -f txt
# Quick setup on new machines
vsix-downloader from-list --file frontend-setup.txt --parallel 5
Editor Auto-Detection: The tool intelligently detects available editors:
# Auto mode prefers Cursor if both editors have extensions
vsix-downloader export-installed --editor auto
# Explicit editor selection when you need specific one
vsix-downloader export-installed --editor cursor # Force Cursor
vsix-downloader export-installed --editor vscode # Force VS Code
Create Extension Lists: Save commonly used extension combinations in files:
# Frontend development stack
./frontend-extensions.json
# Backend development stack
./backend-extensions.json
# Data science toolkit
./datascience-extensions.json
Version Pinning: Always specify exact versions in your JSON for reproducible setups.
Error Recovery: The CLI continues downloading even if one extension fails, so you can retry just the failed ones.
Large Batches: For downloading many extensions, the progress tracking helps you monitor the process.
Organized Storage: Use filename templates and cache directories for better organization:
# Organize by source and publisher
--cache-dir ~/.extensions \
--filename-template "{source}/{publisher}/{name}-{version}.vsix"
# Version-focused naming
--filename-template "{name}_v{version}_{source}.vsix"
Efficient Re-downloads: Use --skip-existing
with cache directories to avoid re-downloading:
# Only download new or updated extensions
vsix-downloader download \
--file ./extensions.json \
--cache-dir ~/.extensions \
--skip-existing
Integrity Verification: Generate and verify checksums for downloaded files:
# Generate checksums for verification
vsix-downloader download \
--file ./extensions.json \
--checksum \
--summary ./results.json
# Verify single extension against known hash
vsix-downloader download \
--url "..." \
--version "1.2.3" \
--verify-checksum "a1b2c3d4e5f6..."
# Verify all files in bulk download against same hash
vsix-downloader download \
--file ./extensions.json \
--verify-checksum "a1b2c3d4e5f6..." \
--parallel 4
https://marketplace.visualstudio.com/items?itemName=ms-python.python
)git clone https://github.com/yourusername/vsix-downloader.git
cd vsix-downloader
npm install
npm run build
npm run dev
npm run build
- Compile TypeScript to JavaScriptnpm run dev
- Run in development mode with ts-nodenpm start
- Run the compiled versionnpm run prepare
- Build before publishingvsix-downloader/
โโโ src/
โ โโโ commands/
โ โ โโโ download.ts # Main download command logic
โ โ โโโ versions.ts # List extension versions
โ โ โโโ exportInstalled.ts # Export installed extensions
โ โ โโโ fromList.ts # Download from extension lists
โ โโโ utils/
โ โ โโโ urlParser.ts # URL parsing utilities
โ โ โโโ downloader.ts # File download utilities
โ โ โโโ fileManager.ts # File system utilities
โ โ โโโ bulkDownloader.ts # Bulk download functionality
โ โ โโโ extensionRegistry.ts # Extension version resolution
โ โ โโโ extensionExporter.ts # Export/import functionality
โ โ โโโ filenameTemplate.ts # Custom filename templates
โ โ โโโ checksum.ts # SHA256 checksum utilities
โ โ โโโ progressTracker.ts # Progress bar utilities
โ โโโ index.ts # CLI entry point
โโโ dist/ # Compiled JavaScript (generated)
โโโ package.json
โโโ tsconfig.json
โโโ README.md
publisher.extension
from Marketplace or OpenVSX URLsitemName
into publisher and extension name~/.vscode/extensions/
~/.cursor/extensions/
package.json
from each extension directoryThe tool constructs download URLs using these patterns:
# Marketplace
https://[publisher].gallery.vsassets.io/_apis/public/gallery/publisher/[publisher]/extension/[extension]/[version]/assetbyname/Microsoft.VisualStudio.Services.VSIXPackage
# OpenVSX
https://open-vsx.org/api/[publisher]/[extension]/[version]/file/[publisher].[extension]-[version].vsix
The tool handles various error scenarios:
We welcome contributions! This project uses a protected main branch workflow to ensure code quality and maintain a clean git history.
git clone https://github.com/YOUR_USERNAME/vsix-downloader.git
cd vsix-downloader
git checkout -b feature/your-feature-name
git push origin feature/your-feature-name
This project uses Conventional Commits for automatic versioning and releases. Please follow this format:
# Format: <type>[optional scope]: <description>
# Examples:
git commit -m "feat: add new download feature"
git commit -m "fix: resolve URL parsing issue"
git commit -m "docs: update README with new examples"
git commit -m "feat!: breaking change in API"
git commit -m "feat(download): add bulk download capability"
Commit Types:
feat
: New featuresfix
: Bug fixesdocs
: Documentation changesstyle
: Code style changes (formatting, etc.)refactor
: Code refactoringperf
: Performance improvementstest
: Adding or updating testschore
: Build process or tooling changesBreaking Changes: Add !
after the type for breaking changes (e.g., feat!: breaking change
)
This project uses GitHub Actions for automated publishing to NPM:
Workflow:
Note: Since main branch is protected, publishing only occurs after PR approval and merge, ensuring all changes are reviewed.
This project is licensed under the MIT License - see the LICENSE file for details.
If you encounter any issues or have questions:
FAQs
A CLI tool to download VS Code extensions as VSIX files from the Visual Studio Marketplace
The npm package vsix-downloader receives a total of 1,535 weekly downloads. As such, vsix-downloader popularity was classified as popular.
We found that vsix-downloader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last weekโs supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.