Open VSX Yanks 77 Evil Twin Extensions Stealing Dev Data

A cluster of 77 malicious extensions was discovered on the Open VSX marketplace, impersonating legitimate developer tools while quietly harvesting sensitive information about the systems and development environments on which they were installed. According to researchers Ax Sharma and Cody Nash at Manifold Security, the "evil twin" packages were uploaded to the registry between July 26 and August 1, 2026, and were removed by Open VSX maintainers on August 3, 2026. The campaign stood out for reusing the names, namespaces, and descriptions of genuine Open VSX extensions, but publishing them under unrelated accounts and pinned to a suspiciously low version number (typically 0.0.1). The core trick: swapping the contents of the bundled extension.js file with data-capture routines disguised as "anonymous usage metrics," while delivering none of the advertised functionality.

The 77 extensions split into two distinct payloads. The first set of 58 lightweight tools exfiltrates only the machine hostname, and in some cases the workspace folder name or editor version. The remaining 19 are far more aggressive reconnaissance payloads that transmit the local hostname and OS username, the editor's name, version, host kind, and machine ID, the platform and architecture, the locale and timezone, and the full filesystem path of the open workspace. They also inspect the workspace's .git directory to harvest Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the HEAD commit SHA, and enumerate up to 60 installed extension IDs. Notable names in this second cluster include amd.gaia-vscode, artsy.artsy-studio-extension-pack, configcat.configcat-feature-flags, openeuphoria.vscode-euphoria, oss.sfmc-devtools-vscode, move.move-analyzer, and vs-publisher-988541.apexsql-power-tools.

All 77 extensions funnel exfiltrated data to a single domain, mangorbit[.]com, which a WHOIS lookup shows was registered just 11 days before the first malicious package appeared, on July 15, 2026, a strong indicator of attacker-prepared infrastructure. The breadth of device-level identifiers collected (machine ID, host kind, OS username, timezone, and extension inventory) effectively gives the operators a rich browser fingerprint test-style profile of every developer who installed these packages, useful for staging follow-on intrusions into source repositories and CI pipelines. Developers who installed any of the listed extensions are advised to uninstall them immediately, rotate credentials for any connected Git remotes, audit commit history for tampering, and run an email breach checker against addresses found in their git config to gauge exposure.