Publisher/Extension Uploading Issue in VS Marketplace

Hi Team,

The error "Your extension has suspicious content" generally appears when the validation system in VS Marketplace detects any missing or unsafe data in the metadata of the extension or its packaging.

One of the issues found during the inspection of the package.json file is that the activationEvents property is left blank:

"activationEvents": []

Instead, you can set a valid activationEvent like:

"activationEvents": [
  "onCommand:extension.start"
]

Following are some other things to keep in mind:

Ensure that all the links such as homepage, repository, bugs.url are active and available publicly.

The GitHub repository should be public.

Eliminate all unnecessary/minimized files in the .vsix packaging.
To publish using the established Visual Studio Code Extensions (VSCE) procedure you can utilize an Azure DevOps Personal Access Token (PAT) as follows:

Recommended Commands:

vsce login  
vsce package 
vsce publish

The problem here is likely due to issues with your metadata meeting validation criteria or security checks of the Marketplace which could prevent your extension from functioning correctly, however, if you’ve correctly updated and installed your activation events and republished via the approved VSCE and Azure DevOps PAT process, this should resolve the problem.

Hi @Dev Cyberscope ,

It looks like the Marketplace scanner is flagging something in your VSIX as “suspicious content.” Usually this comes down to either a mismatch or invalid fields in your extension’s manifest (package.json / source.extension.vsixmanifest) or extra files bundled into the VSIX that aren’t allowed.

You can try below steps

1. Validate your publisher ID
   • In package.json you have "publisher": "CyberscanAI"
   Make sure that exactly matches (including casing) the publisher name you see in the Marketplace portal. The publisher ID in your manifest must be byte‐for‐byte identical to the publisher under which you’re uploading.
2. Trim your manifest to only the supported fields

Only these top‐level properties are allowed in a VS Code extension manifest:

• name, displayName, version, publisher
• engines.vscode
• categories, activationEvents, main, icon
• repository (type + url), bugs.url, homepage, license

Remove or exclude anything else (for example, don’t bundle scripts, devDependencies, dependencies or arbitrary config files into the VSIX). If you’re using vsce to package, you can add a .vscodeignore to filter out node_modules, .git folders, build scripts, etc.

3. Package with vsce (or tfx) and inspect the .vsix

• Install and use the official CLI:

npm install -g vsce  

vsce package  

• Open the resulting .vsix with a zip tool and verify you only see your extension’s code plus the allowed manifest fields no extra JSON, no private config, no huge node_modules tree.

4. Re-upload to the portal

Once your VSIX only contains the allowed manifest and your publisher ID is correct, the “suspicious content” error should clear and your extension will pass the built-in virus/metadata scan.

@Pravallika KV
I have followed all the steps mentioned in both the official documentation and your suggestions, but nothing seems to work.

• My extension only uses axios to call a custom API. I need to include node_modules because when I add it to .vscodeignore, the custom API calls stop working. So I kept node_modules included so that team members can test the extension locally in their own VS Code.
• For Activation Events, I have added all the required events, including UI-related and command-based ones. I have already followed the steps you shared previously. However, my current VS Code version is 1.116.0 while the engine version declared in my extension is 1.110.0. Only these top‐level properties are allowed in a VS Code extension manifest:
• name, displayName, version, publisher
• engines.vscode
• categories, activationEvents, main, icon
• repository (type + url), bugs.url, homepage, license

One thing that stands out is the inclusion of the full node_modules directory inside the VSIX. Even if it’s needed for local testing, Marketplace scanners can flag bundled dependencies—especially large dependency trees or packages that make external API/network calls as suspicious content.

Since you’re using axios only, you may want to try bundling the extension instead of shipping raw node_modules. Tools like esbuild or webpack can package the required code into a smaller output and avoid including unnecessary files that trigger Marketplace validation.

Also, the issue is probably not related to your VS Code engine version mismatch (1.116 vs 1.110). That usually doesn’t cause the “suspicious content” flag by itself.

A few things I would specifically verify:

No secrets/API keys accidentally included in the VSIX

No executable/binary files bundled

Public/reachable repository + homepage URLs

Proper activationEvents (not empty)

Packaging only production dependencies

At this point, inspecting the generated .vsix contents carefully is probably more important than editing metadata again.