Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

A cluster of 77 malicious extensions on the Open VSX marketplace has been discovered impersonating legitimate developer tools while exfiltrating sensitive information from developers’ systems and development environments. Dubbed “evil twin” extensions, they were uploaded between July 26 and August 1, 2026, and have since been removed from Open VSX as of August 3, 2026, according to Manifold Security.

The extensions were designed to mimic real Open VSX extensions by reusing their names, namespaces, and descriptions, but were published through unrelated accounts with low version numbers (e.g., 0.0.1). The core functionality was replaced with code that captures and transmits data, framed as “anonymous usage metrics.” None of the extensions offered the advertised functionality; instead, they displayed a status bar message indicating they were active before initiating data exfiltration.

Of the 77 extensions, 58 were lightweight tools that exfiltrated basic information such as the machine’s hostname, workspace folder name, or editor version. The remaining 19 were reconnaissance payloads that transmitted detailed information including local hostname, OS username, editor name/version, machine ID, platform, architecture, locale, timezone, and the full file system path of the open workspace. All extensions sent data to the domain “mangorbit[.]com,” registered on July 15, 2026, 11 days before the first packages were published.

The reconnaissance variant also performed additional malicious actions: inspecting the workspace’s .git directory to obtain Git remote hosts, organizations, email domains, current branch, and HEAD commit SHA; enumerating installed extension IDs; capturing CI environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite org slug, CircleCI project username, Codespace name, Gitpod workspace context URL); and checking the editor’s telemetry opt-out setting. The malware included contingency plans to query a DNS TXT record for a fallback exfiltration URL if the primary domain was blocked, and featured a retry mechanism that attempted data collection at intervals (15 minutes, 50 minutes, 3.5 hours, then every 7-8 hours) for up to seven days.

This disclosure coincides with a separate software supply chain attack dubbed ChainDrop, where 450 unique npm packages (2,244 artifacts) were compromised to deliver an information stealer. Microsoft attributed the attack to a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered via a Bun-based JavaScript payload. The malware exploited npm preinstall hooks, used stolen GitHub credentials to inject configuration files into repositories, and established persistence through autostart hooks in .claude and .vscode directories. The activity remains unattributed, though it resembles past Shai-Hulud npm worm activity.