Publisher/Extension Uploading Issue in VS Marketplace

Question

Publisher/Extension Uploading Issue in VS Marketplace

Dev Cyberscope 0

Hi Team,

I created a VS Code extension and properly configured the required metadata in the package.json file, including:

Publisher information
Homepage URL
Repository URL
License information
Keywords
Extension description

However, when I try to upload the .vsix file to the Visual Studio Marketplace, I receive the following error:

“Upload Error: Your extension has suspicious content. Please fix your extension metadata, or contact support if you need assistance.”

I have already tried updating and modifying the metadata multiple times based on the error message, but the issue still persists and I am unable to publish the extension.

Also, I am not currently using the Personal Access Token (PAT) method in Azure DevOps, so I would like to know whether I may be missing any required setup or doing something incorrectly during the publishing process.

Could you please review this issue and guide me on what needs to be corrected?

Thank you for your support.

Thanks, CyberscanAI

Screenshot 2026-05-15 122923

Screenshot 2026-05-15 182740

Pravallika KV 15,375 Reputation points Microsoft External Staff Moderator

2026-05-15T15:06:02.26+00:00
Hi @Dev Cyberscope ,

It looks like the Marketplace scanner is flagging something in your VSIX as “suspicious content.” Usually this comes down to either a mismatch or invalid fields in your extension’s manifest (package.json / source.extension.vsixmanifest) or extra files bundled into the VSIX that aren’t allowed.

You can try below steps

Validate your publisher ID

In package.json you have "publisher": "CyberscanAI"

Make sure that exactly matches (including casing) the publisher name you see in the Marketplace portal. The publisher ID in your manifest must be byte‐for‐byte identical to the publisher under which you’re uploading.

Trim your manifest to only the supported fields

Only these top‐level properties are allowed in a VS Code extension manifest:

name, displayName, version, publisher

engines.vscode

categories, activationEvents, main, icon

repository (type + url), bugs.url, homepage, license

Remove or exclude anything else (for example, don’t bundle scripts, devDependencies, dependencies or arbitrary config files into the VSIX). If you’re using vsce to package, you can add a .vscodeignore to filter out node_modules, .git folders, build scripts, etc.

Package with vsce (or tfx) and inspect the .vsix

Install and use the official CLI:

npm install -g vsce vsce package

Open the resulting .vsix with a zip tool and verify you only see your extension’s code plus the allowed manifest fields no extra JSON, no private config, no huge node_modules tree.

Re-upload to the portal

Once your VSIX only contains the allowed manifest and your publisher ID is correct, the “suspicious content” error should clear and your extension will pass the built-in virus/metadata scan.

1 answer

Your answer

Pravallika KV 15,375 Reputation points Microsoft External Staff Moderator

2026-05-15T15:06:02.26+00:00

Hi @Dev Cyberscope ,

It looks like the Marketplace scanner is flagging something in your VSIX as “suspicious content.” Usually this comes down to either a mismatch or invalid fields in your extension’s manifest (package.json / source.extension.vsixmanifest) or extra files bundled into the VSIX that aren’t allowed.

You can try below steps

Validate your publisher ID

In package.json you have "publisher": "CyberscanAI"

Make sure that exactly matches (including casing) the publisher name you see in the Marketplace portal. The publisher ID in your manifest must be byte‐for‐byte identical to the publisher under which you’re uploading.

Trim your manifest to only the supported fields

Only these top‐level properties are allowed in a VS Code extension manifest:

name, displayName, version, publisher

engines.vscode

categories, activationEvents, main, icon

repository (type + url), bugs.url, homepage, license

Remove or exclude anything else (for example, don’t bundle scripts, devDependencies, dependencies or arbitrary config files into the VSIX). If you’re using vsce to package, you can add a .vscodeignore to filter out node_modules, .git folders, build scripts, etc.

Package with vsce (or tfx) and inspect the .vsix

Install and use the official CLI:

npm install -g vsce vsce package

Open the resulting .vsix with a zip tool and verify you only see your extension’s code plus the allowed manifest fields no extra JSON, no private config, no huge node_modules tree.

Re-upload to the portal

Once your VSIX only contains the allowed manifest and your publisher ID is correct, the “suspicious content” error should clear and your extension will pass the built-in virus/metadata scan.

Answer 1

Hi Team,

The error "Your extension has suspicious content" generally appears when the validation system in VS Marketplace detects any missing or unsafe data in the metadata of the extension or its packaging.

One of the issues found during the inspection of the package.json file is that the activationEvents property is left blank:

"activationEvents": []

Instead, you can set a valid activationEvent like:

"activationEvents": [
  "onCommand:extension.start"
]

Following are some other things to keep in mind:

Ensure that all the links such as homepage, repository, bugs.url are active and available publicly.

The GitHub repository should be public.

Eliminate all unnecessary/minimized files in the .vsix packaging.
To publish using the established Visual Studio Code Extensions (VSCE) procedure you can utilize an Azure DevOps Personal Access Token (PAT) as follows:

Recommended Commands:

vsce login  
vsce package 
vsce publish

The problem here is likely due to issues with your metadata meeting validation criteria or security checks of the Marketplace which could prevent your extension from functioning correctly, however, if you’ve correctly updated and installed your activation events and republished via the approved VSCE and Azure DevOps PAT process, this should resolve the problem.

Share via

Publisher/Extension Uploading Issue in VS Marketplace

1 answer

Your answer