Editor extensions auto-update and run with developer privileges, yet they often fall outside software inventory. The Markdown Preview Enhanced research shows why they belong in supply-chain security governance.