The menu bar was silent, so I made my own 50-line VSCode extension and put out the clock.
What happened in this article
immediately after the macOS 26.5.1 (Tahoe) update, the clock disappeared from the menu bar.
All settings were checked. `NSStatusItem Visible Clock` in `defaults read com.apple.controlcenter` is` 1 `,'_HIHideMenuBar `is` 0 ', stage manager is disabled, no MDM profile.* * All settings are correct.Still not rendered * *.
I tried to put in a third-party watch app (Itsycal), but it doesn't make sense if the menu bar itself doesn't appear in the first place.We also considered expanding the clocks in the Marketplace, but * * given the VSCode extended supply chain attacks from 2024 onwards, we weren't inclined to include an unfamiliar author extension * *.
Finally, we solved the problem by locally placing a * * self-extension of less than 50 lines * * written in the `vscode` API and the Node standard alone.It takes 30 minutes.
In this article, we will leave the basis for the decision and the implementation procedure that anyone can imitate.
Environment
| Item | Value | |---|---| | macOS | 26.5.1 (Build 25 F80) | | VSCode | 1.80 + | | Node.js | Optional (extensions do not require vsce packaging) |
Why I avoided third-party extensions
VSCode's Marketplace is * * publisher-friendly * * like npm.There is no pre-screening like in the Apple App Store, and the number of downloads has also been pointed out to be falsified.Examples of actual damage:
- * * 2024-05 * *: Fake `Prettier` extension distributed with PowerShell backdoor - * * 2024-10 * *: `Material Theme` author account with millions of downloads compromised, malicious code mixed version exposed - Cases of counterfeiting/typo squatting (typosquatting/fake packages resembling legitimate package names) against the VS Code Marketplace have not stopped in 2025
The operating costs of * * Publisher's background check, source code review, and re-review per update * * are not commensurate with the smallness of the function of displaying the clock. The "verified badge" is also not a complete guarantee (it does not prevent the author's account itself from being taken over).
"OSS running in good faith by individual developers" can become an attack vector by replacing one commit one day.This is not limited to VSCode expansion, but is the same structural problem as npm's 'event-stream` incident (2018) and PyPI's repeated typosquatting incidents (= supply chain attack).
Why is it safe to make your own?
Self-expansion has three properties that third-party expansion does not have.
1. * * Amount to track in full text * *: The code described below is less than 50 lines in total for package.json and extension.js.Read in a minute 2. * * Zero external dependencies * *: Use only the `vscode` API (= provided by the VSCode body) and the Node standard library; do not pull in additional packages with `npm install` 3. * * Local Operations * *: Just put it on your machine '~/.vscode/extensions/' instead of publishing it on the Marketplace.Since distribution routes do not exist in the first place, there is no entrance for supply chain attacks
The state that "only the code you write will work" can never be created with third-party extensions.This is the biggest advantage of self-made.
Implementation: package.json (20 lines)
`package.json` is the extension's metadata. It declares the minimum version of `vscode`, the entry point, and the configuration schema.
'' 'json { "name": "statusbar-clock", "displayName": "Statusbar Clock", "description": "Show current date/time in VSCode status bar (local-only, zero dependencies)", "version": "0.1.0", "publisher": "nomuraya-local", "private": true, "engines": { "vscode": "^ 1.80.0" }, "main": "./src/extension.js", "activationEvents": [ "onStartupFinished" ], "contributes": { "configuration": { "title": "Statusbar Clock", "properties": { "statusbarClock.
format ": { "type": "string", "default": "yyyy-MM-dd (EEE) HH: mm: ss", "description": "Display format. Tokens: yyyy MM dd HH mm ss EEE (weekday)" } } } } } ```
Points:
- `activationEvents: ["onStartupFinished"]': Loaded after VSCode activation is complete.Do not delay startup - `contributes.configuration': Declaration to display items on the VSCode configuration screen.Now you can change the formatting from Cmd +, - `publisher: "nomuraya-local"': optional name for local.Don't put it on the marketplace, so you don't have to worry about conflicts
Implementation: extension.js (30 lines)
The VSCode extension works when you export the `activate (context)' function.Just create a status bar item and update the text every second with setInterval.
'' 'javascript const vscode = require ('vscode');
const weeks = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
function pad (n) {return String (n) .padStart (2, '0');}
function formatDate (fmt, d) { return fmt .replace ('yyyy', d.getFullYear ()) .replace ('MM', pad (d.getMonth () + 1)) .replace ('dd', pad (d.getDate ()) .replace ('HH', pad (d.getHours ()) .replace ('mm', pad (d.getMinutes ()) .replace ('ss', pad (d.getSeconds ()) .replace ('EEE', weeks [d.getDay ()]);}
let statusBarItem; let timer;
function activate (context) { //Make an item on the right side of the status bar.The second argument, priority = 1000, is closer to the right end. statusBarItem = vscode.window.createStatusBarItem (vscode.StatusBarAlignment.Right, 1000); statusBarItem.show (); context.subscriptions.push (statusBarItem);
//Refresh view every second const update = () = > { const fmt = vscode.workspace.getConfiguration ('statusbarClock') .get ('format'); statusBarItem.text = formatDate (fmt, new Date ()); }; update (); timer = setInterval (update, 1000);
//Stop setInterval when extension is deactivated context.subscriptions.push ({dispose: () = > clearInterval (timer)}); }
function deactivate () { if (timer) clearInterval (timer); if (statusBarItem) statusBarItem.dispose (); }
module.exports = {activate, deactivate}; ```
I only use 3 VSCode APIs:
| API | Role | |---|---| | `vscode.window.createStatusBarItem (alignment, priority)' | Create a frame in the status bar | | `statusBarItem.text = "..."' | Update the display string | | `vscode.workspace.getConfiguration ("ns") .get ("key")' | Read values written in settings screen |
There are no network access, file read/write, or child_process calls.* * This extension can only "show text in the status bar" * *.There is a sense of security that even if my code has a bug, it will not be a security incident.
Distribution: No vsix build required, just one symlink
For normal VSCode extensions, create `.vsix` with `vsce package` and insert it with `code --install-extension`.However, in my environment, the npm of node24 was broken and `vsce` did not move ('module_not_found` of the CJS loader).
Instead, * * '~/.vscode/extensions/' * * is recognized as a development mode extension by simply pasting the symlink.
'' 'bash Ext_dir = "$ Home/.vscode/extensions/nomuraya-local.statusbar-clock-0.1.0" mkdir-p "$ Home/.vscode/extensions" ln -s ~/workspace-ai/nomuraya-tools/vscode-statusbar-clock "$ ext_dir" ```
The directory name convention is`<publisher>.<name> -<version> '. Match` publisher ',' name `,` version `in package.json.
After placement, if you * * completely exit and restart VSCode with Cmd + Q * *, '2026-06-09 (Tue) 07:23:45` will be displayed in seconds at the bottom right of the status bar.
State after operation check
- Always see the time while VSCode is open (= no problem if the menu bar is dead) - You can change the format by changing `statusbarClock.format` in the settings (Cmd +,).Example: '"HH: mm"' (time only)/'"MM/dd HH: mm"' (abbreviated) - If you want to uninstall, just `rm` symlink.No registry contamination or remnants of settings.json
To summarize: The ability to write something that moves is the last line of defense for security
The flow of supply chain attacks has not stopped: npm, PyPI, VSCode Marketplace, Chrome Web Store have all experienced serious incidents in the past few years. Neither the verified badge nor the number of downloads is a complete guarantee.
The ultimate certainty is that you will * * write your own code the size you can read * *.
Only three VSCode APIs were required to write 50-line extensions: createStatusBarItem, setText, and getConfiguration.It moved in 30 minutes.This is not a special skill, but a story that can be written while reading documents.
The menu bar was silenced, so I put my watch on the status bar.That's all, but if you have an option that doesn't rely on third-party expansion, when you see the news of the "Material Theme Author Hijacking Case", you can say that your machine is safe.
References
- [VSCode Extension API: StatusBarItem] (https://code.visualstudio.com/api/references/vscode-api#StatusBarItem) - [Material Theme malware incident (2024-10)] (https://www.bleepingcomputer.com/news/security/vscode-marketplace-removes-two-extensions-deploying-early-stage-ransomware/) - [Fake Prettier extension backdoor (2024-05)] (https://www.reversinglabs.com/blog/illusion-of-trust-malicious-vscode-extensions)
---
*Machine-translated (MyMemory API) from a Japanese original at [nomuraya-hub.pages.dev](https://nomuraya-hub.pages.dev/). Pre-review draft. I am the same author writing under different pen names — "nomuraya / shimajima / 中翔" — depending on the medium.*