# E03. Editor-extension package analysis

## Package identity

The recorded VSIX was collected on 22 July 2026 and inspected without installation. Its size is 17,647,582 bytes and SHA-256 is `52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7`. The manifest names `google-update-support`, publisher `google-dev-tools`, version `1.0.0`, and activation event `onStartupFinished`. The installed identifier is `google-dev-tools.google-update-support`. These are package claims, not evidence of affiliation with Google. [S1]

## Activation and configuration

The startup activation event can permit extension activity after the initial lure workspace is removed, provided the extension remains installed and enabled. Repository cleanup therefore does not establish removal of the installed component. The source record describes cleanup of workspace task and staging files after installation. Neither the manifest nor cleanup code establishes that a particular user permitted installation. [S1]

Workspace configuration supplies the server URL, client identifier and agent token through the `googleUpdateSupport` namespace. Other keys select the agent archive and Windows activation mode. Empty defaults in the manifest show why the extension alone may be insufficient to reconstruct a deployment's destination. No token values are reproduced.

## Bundled native agents

The nested archive contains three recorded Go agents. Their SHA-256 values are:

- macOS arm64: `339907b44f161f57ff30819f422c552382ff437b3ae437463b4222cfe86bd943`.
- macOS amd64: `bb10adac5b0124efedfe71102c1d5638135ec9e1cde8c8cb3353c5ed91bb9f81`.
- Linux amd64: `a2b9a769df84d9d3a4694bb0252a2c6a5e5f5d1a85a04565362737092bbb3a86`.

The case record reports matches with previously published indicators. The match establishes byte identity for those samples, not execution or ownership. A separate Windows JavaScript pipeline is covered in E04. [S1]

## Build interpretation

The May agents and a July implant expose different VCS revisions. The macOS arm64 agent records cgo enabled; other examined builds differ. These are build attributes, not a unique identification of a physical machine. VCS timestamps should not be relabeled as certified compilation times. No editor execution, persistence test or fresh external hash lookup was performed. [S1, S2]